Push Security has documented a phishing campaign that uses fake registration pages for OpenAI, SpaceX and Anthropic events to take over Microsoft and Google work accounts. The pages advertise an OpenAI Academy livestream, a private SpaceX briefing and an Anthropic session at AWS re:Invent, with rewards such as three months of ChatGPT Pro, three months of Grok Heavy or a “SpaceX share”. To claim the reward, visitors are told to sign in with their work account. Push detected and blocked visits in late October 2026; the operator moved between Zoom, Anthropic, OpenAI, SpaceX and Claude themes between October 20 and October 30.
Each page offers “Continue with Microsoft” and “Continue with Google”, and each button leads to a different phishing-as-a-service platform. The Microsoft button starts a device code login through Kali365: the visitor is shown a code and told to enter it on Microsoft’s real device login page, which hands the attacker authentication tokens without the password and sidesteps MFA. The page then passes the victim to a VoidProxy Microsoft sign-in page, giving the operator a second capture of the password and session cookie. The Google button opens a VoidProxy reverse proxy of Google’s sign-in page that relays the login, the MFA response and the session cookie. Push says it has seen nothing linking the Kali365 and VoidProxy developers and thinks the operator is a customer of both. BleepingComputer reports that the operators hide the pages behind a Cloudflare CAPTCHA, and Push notes that the lure domains rotate every few weeks (one was three days old when investigated). BleepingComputer says it is unclear how the attackers first distribute the links, though earlier waves used GoTo Webinar’s mail system and real Zoom event pages; Push says the delivery chain uses trusted services such as zpr.io, Google short links and X.
How to check if you’re affected
Affected products are Microsoft and Google work accounts that someone signed into from one of these event pages, or that approved a Microsoft device code for an event they did not attend. Push lists these lure and infrastructure indicators from the campaign, and says they are most useful for hunting back through logs for earlier visits, since the operator rotates domains and they have limited value on their own:
eventrsvp[.]appand subdomains such asopenai.eventrsvp[.]appandspacex.eventrsvp[.]apprsvpconnect-events[.]comandanthropic.rsvpconnect-events[.]comclaudewebinnar[.]comand its subdomains- collection server
217.60.102[.]48
BleepingComputer’s guidance is to never enter a Microsoft device code that an unfamiliar website gave you, to be wary of event invitations that require a corporate sign-in to claim a reward, to restrict device code authentication where it is not needed, and to use phishing-resistant MFA such as FIDO2 security keys. If someone did enter a code or sign in, a cautious step (not stated in either source) is to treat the account as compromised and ask your administrator to revoke its sessions and tokens.
Sources
- Push Security: Analyzing a fake event campaign combining AiTM and device code phishing payloads
- BleepingComputer: Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
- Cofense: Would Your Employees Join a Fake Anthropic AI Preview?
- Earlier coverage on this site: FBI warns of Kali365 phishing against Microsoft 365