Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

Hackers are utilizing phony OpenAI, SpaceX, and Anthropic occasion invites to tempt staff members into phishing attacks, utilizing 2 various phishing-as-a-service platforms to take Microsoft and Google account qualifications and authentication sessions.

According to a brand-new report from Push Securitythe opponents utilize persuading occasion registration pages using open door to premium AI services and other benefits to deceive victims into finalizing in with their business accounts.

What makes the attacks fascinating is that the exact same phishing pages incorporate 2 different phishing-as-a-service (PhaaS) platforms, Kali365 and VoidProxy, to target Microsoft and Google accounts utilizing various authentication attacks.

Kali365 performs Microsoft gadget code phishing attacks, while VoidProxy serves as an adversary-in-the-middle(AiTM)reverse proxy to obstruct Google sign-ins and take authentication session cookies.

The Microsoft attack likewise utilizes VoidProxy as a 2nd phase, enabling enemies to catch qualifications and session cookies after getting authentication tokens through Kali365.

Press Security states it spotted and obstructed check outs to the harmful occasion registration pages in late October 2026.

The project follows a comparable project recorded by ANY.RUN in July, when assailants mistreated genuine Zoom occasion pages to promote phony Meta, OpenAI, and Anthropic occasions that resulted in gadget code and AiTM phishing attacks.

Cofense likewise just recently reported on phishing e-mails impersonating Anthropic occasion invites that were dispersed through GoTo Webinar’s e-mail facilities and rerouted receivers through numerous sites to phony registration pages.

news Phony AI occasions cause account phishing

While it is uncertain how the enemies at first disperse the phishing links, Push Security discovered that they reroute victims to a destructive occasion registration page utilizing links from relied on services, consisting of Google and Zapier URL shorteners.

Invites from earlier variations of the project were likewise dispersed through GoTo Webinar’s e-mail systems or genuine Zoom occasion pages.

Press Security states the assailants utilize 2 custom-made phishing sets, tracked as ZoomMock and MSDRoot, to produce phony occasion pages that then direct victims to the Kali365 and VoidProxy phishing services.

The scientists think the exact same hazard stars run both sets, as they utilize shared facilities and the very same targeting.

The project impersonates occasions hosted by OpenAI, SpaceX, and Anthropic, with registration pages developed to look like genuine occasion sites.

One phishing page markets an OpenAI occasion entitled “ChatGPT for Social & Digital Marketing Teams” that assures 3 months of ChatGPT Pro to individuals.

Another promotes a personal SpaceX occasion on November 12, providing registrants either 3 months of Grok Heavy or a “SpaceX share.”

The scientists likewise discovered a phishing page impersonating an Anthropic occasion at AWS re: Invent 2026 that was currently removed.

The phony registration pages inform visitors they should check in with their work accounts to sign up and declare the marketed benefits.

Before showing the phony registration pages, the sites reveal a Cloudflare CAPTCHA to “Confirm you’re not a robot.” This avoids automatic security platforms from scanning the phishing website.

When visitors reach the occasion registration page, they see 2 alternatives: “Continue with Microsoft” and “Continue with Google.”

When victims pick the Microsoft alternative, the phishing page contacts the Kali365 platform to produce a Microsoft gadget authentication code.

A gadget code phishing attack takes place when an aggressor abuses the genuine OAuth 2.0 gadget permission grant circulation to get authentication tokens for the victim’s Microsoft Entra account.

This can then be utilized to access the user’s resources and linked SSO applications, such as Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and numerous others.

Gadget code phishing attacks have actually been utilized in the past for information theft and cyberespionage attacks.

The visitor is advised to copy the code and enter it on Microsoft’s genuine gadget login site, where they validate and authorize the demand.

This permits the Kali365 phishing platform to take Microsoft authentication tokens without needing the victim to reveal their password straight.

After the gadget code authentication is successful, the page reroutes the victim to a VoidProxy Microsoft login page, where opponents can likewise catch the victim’s password and session cookie.

When victims choose the Google authentication alternative, the phishing page rather opens a pop-up including a Google login page from the VoidProxy PhaaS.

The platform runs as an adversary-in-the-middle (AiTM) platform that sits in between the victim’s internet browser and Google’s login page, proxies the login kinds, and takes qualifications, MFA reactions, and session cookies.

Both the Kali365 and VoidProxy platforms let enemies bypass multifactor authentication by recording a currently validated session or, when it comes to gadget code authentication, bypassing MFA totally.

To safeguard versus these attacks, workers need to prevent going into Microsoft gadget authentication codes offered by unknown sites and beware of occasion invites that need finalizing in with business accounts to declare benefits.

Organizations can likewise limit gadget code authentication where it is not required and utilize phishing-resistant MFA, such as FIDO2 security secrets, to assist avoid session hijacking.

news

Discover e-mail hazards your existing defenses might miss out on.

Adaptive Security’s AI representatives evaluate e-mail intent, context, and habits to reveal phishing, service e-mail compromise, and billing scams.

See what’s making it through with a 14-day read-only scan of Microsoft 365 or Google Workspace, without any MX modifications.

Start your complimentary e-mail security scan.