Fake event invitations posing as OpenAI, SpaceX and Anthropic events are being used to steal corporate Microsoft and Google accounts, according to a November 5 investigation from Push Security. The pages offer free access to premium AI services or other rewards, but require visitors to sign in with their work accounts. Push said it detected and blocked visits to the campaign’s registration pages on customer browsers in late October 2026.
The lures included an OpenAI Academy livestream promising three months of ChatGPT Pro, a private SpaceX briefing offering three months of Grok Heavy or a purported SpaceX share, and an Anthropic event tied to AWS re:Invent. Push observed the current OpenAI and SpaceX pages from October 29 to November 2; the invitations advertised events scheduled for November 4 and November 12 respectively. An Anthropic-themed page had appeared earlier in the campaign. The registration pages offered separate options to continue with Microsoft or Google.
The Microsoft route used Kali365 to generate an OAuth device-authentication code. Victims were directed to enter that code on Microsoft’s legitimate device-login page and approve the request, allowing attackers to obtain authentication tokens for the account. The page then redirected them to a VoidProxy-operated Microsoft sign-in page, which could capture the password and session cookie as a second stage. Similar device-code flows have appeared in a Kali365 phishing operation and a separate campaign targeting U.S. businesses.
The Google option opened a VoidProxy adversary-in-the-middle page that relayed Google’s real sign-in process while collecting the user’s password, multifactor-authentication response and session cookie. Because the phishing service sits between the user and the legitimate login page, it can capture an authenticated session even after the victim completes an MFA challenge. Push said the Microsoft and Google routes use different authentication attacks, although both are designed to defeat account protections.
Push tracks the fake event-page kits as ZoomMock and MSDRoot. The company assessed the link between those two kits as medium-high, based largely on a domain shared by both operations. It did not find evidence connecting the developers of Kali365 and VoidProxy; the two are separate subscription phishing services used by the campaign operator. The pages also used Google and Zapier short links, an X redirect and a Cloudflare managed challenge that stopped many automated scanners before they reached the registration pages.
A successful sign-in could expose Microsoft Entra accounts and services connected through single sign-on, including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk and Atlassian. The Google route separately targets Google accounts and their authenticated sessions. Push’s investigation describes the campaign as an email-delivered lure operation that combines familiar AI brands with device-code and adversary-in-the-middle phishing to capture credentials and reusable sessions.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
