Microsoft and Google corporate accounts — and the third‑party services they unlock — are the explicit target after attackers used fake OpenAI, SpaceX and Anthropic event invitations to steal credentials and active authentication sessions, according to a new report from Push Security.
How the fake event pages lure victims
Push Security found the campaign uses convincing event registration pages that promise free access to premium AI services or other rewards. Examples include an OpenAI event titled "ChatGPT for Social & Digital Marketing Teams" promising three months of ChatGPT Pro, a private SpaceX event on November 12 offering registrants either three months of Grok Heavy or a "SpaceX share," and an impersonated Anthropic event at AWS re:Invent 2026 that was taken down. The fake pages require visitors to "sign in with their work accounts" to register and claim the advertised rewards.
Before showing the registration forms, the phishing sites present a Cloudflare CAPTCHA to "Confirm you're not a robot," a step Push Security says prevents automated security platforms from scanning the pages. The researchers also observed that the campaign redirects victims via links from trusted services, including Google and Zapier URL shorteners, and that earlier versions distributed invitations through GoTo Webinar's email systems or legitimate Zoom event pages.
Kali365 and the Microsoft device‑code workflow
When a victim chooses "Continue with Microsoft," the phishing page contacts the Kali365 platform to generate a Microsoft device authentication code. Push Security describes this as an abuse of the OAuth 2.0 device authorization grant flow: the visitor is instructed to copy the code and enter it on Microsoft's legitimate device login website, where they authenticate and approve the request. Kali365 then captures Microsoft authentication tokens without requiring the victim to disclose their password directly.
The report notes that a successful Entra authentication token can grant access not only to Microsoft 365 but to many connected single‑sign‑on applications, enumerating Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk and Atlassian among others. After the device code step completes, Push Security observed the page redirect victims to a VoidProxy Microsoft login page where attackers can capture the password and the session cookie as a second stage.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageVoidProxy as an adversary‑in‑the‑middle for Google sign‑ins
For victims who select "Continue with Google," Push Security found the page opens a pop‑up containing a Google login that is in fact proxied by the VoidProxy phishing‑as‑a‑service platform. VoidProxy operates as an adversary‑in‑the‑middle (AiTM) reverse proxy that sits between the victim's browser and Google's login page, relays the login forms, and captures credentials, multifactor authentication responses, and session cookies.
Both Kali365 and VoidProxy allow attackers to bypass multifactor protections: VoidProxy can seize an already authenticated session or intercept MFA responses, while the device code method used by Kali365 can bypass MFA entirely, according to Push Security.
Infrastructure: ZoomMock, MSDRoot and shared tooling
Push Security traced two custom phishing kits used to build the fake registration pages, tracked as ZoomMock and MSDRoot. The researchers say the kits share infrastructure and targeting, leading them to believe the same threat actors operate both. The kits funnel victims into the Kali365 and VoidProxy services as distinct phishing stages.
The campaign follows related activity documented earlier in 2026: ANY.RUN reported in July that attackers abused legitimate Zoom event pages to promote fake Meta, OpenAI and Anthropic events that led to device code and AiTM phishing, and Cofense recently reported phishing emails impersonating Anthropic event invitations distributed through GoTo Webinar's email infrastructure and redirecting recipients through multiple sites to fake registration pages.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: Push Security’s findings point to concrete mitigations — restrict device code authentication where it is not needed and deploy phishing‑resistant MFA such as FIDO2 security keys to reduce session‑hijacking risk.
- Enterprises and procurement leaders: Be wary of third‑party event platforms and the potential for legitimate webinar infrastructure to be abused; evaluate whether corporate sign‑in should be required to claim promotional rewards and whether device code flows are enabled for your tenant.
- End users and employees: Avoid entering Microsoft device authentication codes provided by unfamiliar websites and exercise caution with event invitations that demand signing in with corporate accounts to claim rewards.
Conclusion
Push Security detected and blocked visits to the malicious registration pages in late October 2026, but the campaign illustrates a persistent pattern: attackers package familiar lures — AI events, free subscriptions, private invites — into registration flows that combine multiple PhaaS tools to steal both credentials and active sessions. Organizations that continue to permit device‑code flows or rely solely on password plus SMS‑ or TOTP‑based MFA remain exposed; the report points to FIDO2 and disabling unnecessary device flows as immediate, targeted defenses.
Read the Push Security coverage at Bleeping Computer: https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
