Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions.

According to a new report from Push Security, the attackers use convincing event registration pages offering free access to premium AI services and other rewards to trick victims into signing in with their corporate accounts.

What makes the attacks interesting is that the same phishing pages integrate two separate phishing-as-a-service (PhaaS) platforms, Kali365 and VoidProxy, to target Microsoft and Google accounts using different authentication attacks.

Kali365 conducts Microsoft device code phishing attacks, while VoidProxy acts as an adversary-in-the-middle (AiTM) reverse proxy to intercept Google sign-ins and steal authentication session cookies.

The Microsoft attack also uses VoidProxy as a second stage, allowing attackers to capture credentials and session cookies after obtaining authentication tokens through Kali365.

Push Security says it detected and blocked visits to the malicious event registration pages in late October 2026.

The campaign comes after a similar campaign documented by ANY.RUN in July, when attackers abused legitimate Zoom event pages to promote fake Meta, OpenAI, and Anthropic events that led to device code and AiTM phishing attacks.

Cofense also recently reported on phishing emails impersonating Anthropic event invitations that were distributed through GoTo Webinar's email infrastructure and redirected recipients through multiple websites to fake registration pages.

Fake AI events lead to account phishing

While it is unclear how the attackers initially distribute the phishing links, Push Security found that they redirect victims to a malicious event registration page using links from trusted services, including Google and Zapier URL shorteners.

Invitations from earlier versions of the campaign were also distributed through GoTo Webinar's email systems or legitimate Zoom event pages.

Push Security says the attackers use two custom phishing kits, tracked as ZoomMock and MSDRoot, to create fake event pages that then direct victims to the Kali365 and VoidProxy phishing services.

The researchers believe the same threat actors operate both kits, as they use shared infrastructure and the same targeting.

The campaign impersonates events hosted by OpenAI, SpaceX, and Anthropic, with registration pages designed to resemble legitimate event websites.

One phishing page advertises an OpenAI event titled "ChatGPT for Social & Digital Marketing Teams" that promises three months of ChatGPT Pro to participants.

OpenAI phishing page
Source: BleepingComputer

Another promotes a private SpaceX event on November 12, offering registrants either three months of Grok Heavy or a "SpaceX share."

The researchers also found a phishing page impersonating an Anthropic event at AWS re:Invent 2026 that was already taken down.

The fake registration pages tell visitors they must sign in with their work accounts to register and claim the advertised rewards.

Before displaying the fake registration pages, the websites show a Cloudflare CAPTCHA to "Confirm you're not a robot." This prevents automated security platforms from scanning the phishing site.

Once visitors reach the event registration page, they see two options: "Continue with Microsoft" and "Continue with Google."

When victims select the Microsoft option, the phishing page contacts the Kali365 platform to generate a Microsoft device authentication code.

Microsoft device code authentication form on phishing site
Source: BleepingComputer

A device code phishing attack occurs when an attacker abuses the legitimate OAuth 2.0 device authorization grant flow to obtain authentication tokens for the victim's Microsoft Entra account.

This can then be used to access the user's resources and connected SSO applications, such as Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and many others.

Device code phishing attacks have been used in the past for data theft and cyberespionage attacks.

The visitor is instructed to copy the code and enter it on Microsoft's legitimate device login website, where they authenticate and approve the request.

This allows the Kali365 phishing platform to steal Microsoft authentication tokens without requiring the victim to disclose their password directly.

After the device code authentication succeeds, the page redirects the victim to a VoidProxy Microsoft login page, where attackers can also capture the victim's password and session cookie.

When victims select the Google authentication option, the phishing page instead opens a pop-up containing a Google login page from the VoidProxy PhaaS.

The platform operates as an adversary-in-the-middle (AiTM) platform that sits between the victim's browser and Google's login page, proxies the login forms, and steals credentials, MFA responses, and session cookies.

Both the Kali365 and VoidProxy platforms let attackers bypass multifactor authentication by capturing an already authenticated session or, in the case of device code authentication, bypassing MFA entirely.

To protect against these attacks, employees should avoid entering Microsoft device authentication codes provided by unfamiliar websites and be cautious of event invitations that require signing in with corporate accounts to claim rewards.

Organizations can also restrict device code authentication where it is not needed and use phishing-resistant MFA, such as FIDO2 security keys, to help prevent session hijacking.