Hackers use fake OpenAI and SpaceX event invites to steal Microsoft and Google accounts

How the attack worked

Hackers are sending out convincing fake event invitations, pretending to be from well-known companies like OpenAI, SpaceX, and Anthropic. The invitations promise rewards such as free access to premium AI services or even a "SpaceX share" for signing up. When recipients click the links, they are taken to event registration pages that closely mimic legitimate sites. According to Push Security↗ (opens in a new tab), these phishing pages use two different phishing-as-a-service (PhaaS) platforms: Kali365 and VoidProxy.

The attackers use trusted services like Google and Zapier to shorten and redirect the phishing links, making them harder for security filters to detect. Sometimes, the emails are sent through legitimate webinar services like GoTo Webinar or Zoom, adding to the appearance of legitimacy. Before showing the fake registration form, the page displays a Cloudflare CAPTCHA to block automated security scans.

How the flaw works

Victims are given two options to sign up: "Continue with Microsoft" or "Continue with Google." Each option triggers a different attack method:

• Microsoft accounts: The page uses Kali365 to launch a device code phishing attack. Victims are told to enter a code on Microsoft's real device login page. If they do, attackers get authentication tokens for the victim's Microsoft account, letting them access services like Microsoft 365, Salesforce, Dropbox, and more. After this, VoidProxy is used as a second stage to capture credentials and session cookies.

• Google accounts: The page uses VoidProxy, which acts as an adversary-in-the-middle (AiTM) proxy. It sits between the victim and Google's login page, intercepting credentials, multi-factor authentication (MFA) responses, and session cookies. This lets attackers bypass MFA and take over the account.

Both attack methods are designed to get around common security controls, including MFA, by stealing session cookies or using OAuth device code flows.

Who is affected

The campaign targets employees who use Microsoft and Google accounts, especially those interested in AI tools or events. The phishing pages are tailored to look like real event sign-ups from OpenAI, SpaceX, and Anthropic, making them more likely to trick people in tech, marketing, and related fields. Push Security detected and blocked visits to these malicious pages in late October 2026, but it is unclear how many people have fallen victim so far.

The response

Push Security has published details of the attack and blocked access to the malicious sites for its customers. They recommend that employees avoid entering device authentication codes from unfamiliar sources and be wary of event invitations that require logging in with corporate accounts to claim rewards. Organisations should consider restricting device code authentication and using phishing-resistant MFA, such as FIDO2 security keys, to reduce the risk of session hijacking.

What you should do

• Be cautious of event invitations that promise rewards or require you to log in with your work account.
• Never enter Microsoft device codes from websites you do not trust.
• Use phishing-resistant MFA methods where possible, like security keys.
• Organisations should review and restrict device code authentication if not needed, and educate staff about these phishing tactics.

Has this happened before?

Similar campaigns have been reported in the past. In July 2026, attackers used fake Zoom event pages to promote bogus Meta, OpenAI, and Anthropic events, leading to similar phishing attacks. Cofense also reported phishing emails impersonating Anthropic events sent through GoTo Webinar's email system.