Fake OpenAI and SpaceX events used to steal Microsoft and Google accounts
Original title: Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers run fake registration pages for AI events that integrate Kali365 device-code phishing and VoidProxy AiTM to capture credentials and sessions.
Attackers create convincing event pages for OpenAI, SpaceX, and Anthropic events offering free AI services as rewards. They redirect victims to Kali365 for Microsoft device code phishing and VoidProxy for Google sign-in interception. Both platforms bypass MFA. The campaign was detected in late October 2026.
Unconfirmed: Initial distribution method and exact threat actor group not identified
- Two custom phishing kits tracked as ZoomMock and MSDRoot
- Kali365 handles Microsoft device code authentication
- VoidProxy acts as adversary-in-the-middle for Google logins
Impact: Account credential and session theft via phishing
| Product | Affected |
|---|---|
| Microsoft Entra ID | — |
| Google Workspace | — |
- 1.Avoid entering device codes from unfamiliar sites
- 2.Use phishing-resistant MFA like FIDO2 keys
- 3.Restrict device code auth to required scenarios
From the original article
4 min read at bleepingcomputer.com
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.