Fake OpenAI, SpaceX and Anthropic event invites harvest Microsoft and Google accounts
Push Security: fake OpenAI, SpaceX and Anthropic event invites chain device code phishing and AiTM proxies to steal Microsoft and Google sessions despite MFA.
Registration pages for events that do not exist — an OpenAI Academy livestream, a private SpaceX briefing, an Anthropic appearance at AWS re:Invent — have been harvesting Microsoft and Google work accounts since late October. The lures promise three months of ChatGPT Pro, Grok Heavy, even “a SpaceX share,” if you sign in with your work account to claim them. Push Security, which says it detected and blocked visits to the pages in late October, published its research this week; BleepingComputer covered it on November 5 and TechRadar followed on November 6. The infrastructure domain Push examined on November 2, eventrsvp[.]app, was then three days old.
Key points
- The Microsoft path runs through Kali365’s device code phishing: the victim approves a request on Microsoft’s real device login page, and Microsoft then issues OAuth tokens to the attacker’s Kali365 session. No password is stolen, because none is needed — the victim’s own MFA approves the attacker’s access.
- The Google path runs through VoidProxy, an adversary-in-the-middle reverse proxy that relays the genuine Google sign-in flow and captures the password, the MFA response and the session cookie — enough to hijack an authenticated session without defeating MFA.
- Push attributes the campaign to one operator cycling through two templates — ZoomMock fake Zoom pages since May 2026, MSDRoot pages since October 22 — based on shared infrastructure and targeting, not shared code; the developers of the rented Kali365 and VoidProxy platforms show no link to each other.
Background
Fake invitations riding on trusted AI brands are not a new trick; this wave is the latest generation of one product line. Push’s timeline starts in May 2026 with the first ZoomMock pages imitating Zoom events. On July 15, ANY.RUN reported lures hosted on real zoom.us “partner summit” pages that branched into device code and AiTM phishing. On October 29, Cofense reported Anthropic invites — “Austin from nthropic” — sent through GoTo Webinar’s mail system. Between October 20 and 30, the operator pivoted its themes from Zoom to Anthropic, then to OpenAI, SpaceX and Claude. The recipe matches the fake calendar invite campaign Check Point measured last month, which hit more than 40,000 organizations with 740,000+ emails in early October — again exploiting no vulnerability, just trust in a plausible invitation. AI branding keeps showing up in these campaigns for the same reason: they are the names people click first.
Device codes and reverse proxies
Device code phishing is the first stage on the Microsoft path. When the victim clicks “Continue with Microsoft” on a lure page, the page requests a device code from Kali365’s backend and shows a “Confirm access” dialog. The “Open Microsoft” button opens Microsoft’s genuine device login page, login.microsoftonline.com/common/oauth2/deviceauth, in a pop-up. The victim pastes the code, signs in, approves the request — MFA completes on the real page — and Microsoft issues the resulting OAuth tokens to the attacker’s Kali365 session. BleepingComputer’s phrasing: Kali365 abuses “the legitimate OAuth 2.0 device authorization grant flow” to obtain Entra tokens without a password. The victim is then handed to a VoidProxy-proxied Microsoft sign-in page, which captures the password and the session cookie in a second pass.
The Google path is VoidProxy end to end. The page opens a pop-up titled “Portal” that relays Google’s real sign-in flow, capturing the password, the MFA response and the session cookie; with the cookie, the attacker takes over an already-authenticated session. Neither payload fights MFA head-on — one gets the victim to approve it, the other takes the session whole.
The cover layer is just as systematic, per Push’s research. Lure domains sit behind a Cloudflare managed challenge that hides them from public scanners, and VoidProxy’s Microsoft proxies serve scanners real news sites. Invitation links hop through Google short links (c.gle, share.google) or Zapier’s zpr.io; one link chained an x.com logout redirect in front of the short link. “Short links and open redirects on trusted domains are common techniques for evading reputation-based URL checks,” Push writes. The three lures Push documented on November 2:
| Fake event | Date | Promised reward | Payload |
|---|---|---|---|
| OpenAI Academy livestream, “ChatGPT for Social & Digital Marketing Teams” | Nov 4 | 3 months of ChatGPT Pro | Kali365 device code, then VoidProxy |
| SpaceX “Starship Product Briefing” | Nov 12 | 3 months of Grok Heavy or a “SpaceX share” | Same chain |
| Anthropic at AWS re:Invent | December conference | Registration | Page already offline when examined |
The rebranding left traces: the OpenAI page contains URLs that mention Claude and a “Same as Claude” code comment. Registration demands a work-account sign-in; the collection server was eventrsvp-217-60-102-48.sslip[.]io/collect.php (IP 217.60.102[.]48), on domains patterned <brand>.eventrsvp[.]app/event/<brand>/id<11 digits>/rsvp/.
What others say
Push Security’s read on the bait: “Employees want access to the latest AI tools, making them excellent bait for attacks.” It describes the payloads as “the MFA-bypassing AiTM and device code phishing payloads,” built to slip past defenses that lean on URL reputation, email gateways and scanners. BleepingComputer (Lawrence Abrams, November 5) tightens the attribution: ZoomMock and MSDRoot are “believed to be run by the same threat actors,” on the strength of shared infrastructure and targeting rather than shared code, and the distribution channel remains unknown — phishing emails, social channels and Telegram groups are all plausible. TechRadar (Sead Fadilpašić, November 6) sets the campaign in a longer list: July’s fake Meta, OpenAI and Anthropic invites on legitimate Zoom event pages (ANY.RUN), Cofense’s GoTo Webinar Anthropic invites, fake Claude install pages bought through search ads, and malicious links disguised as shared AI conversations, artifacts and custom GPTs. The outlets do not conflict; they cover different ground — Push the mechanism and indicators, BleepingComputer the attribution and the distribution gap, TechRadar the lineage.
Our take
For defenders, the point this AI event invite campaign proves is that having MFA is not the same as MFA protecting you. Device code phishing gets the victim to complete the authentication themselves, so every MFA check passes; the AiTM proxy pockets the MFA response along with the session cookie, and after that the attacker never needs credentials again. The fix that covers both paths is a phishing-resistant credential — we made this case in Passkeys are not a trap: TOTP can be relayed in real time, while a passkey bound to its issuing domain fails inside a reverse proxy. BleepingComputer’s checklist agrees: never enter a device code from an unfamiliar site, disable device code authentication where it is not needed, and use FIDO2 security keys where you can. Two honest caveats. Push sells browser-layer detection, so its “detect payloads as they render” prescription is its own product position. And the indicators have a short shelf life: Push itself notes the operator rotates domains every few weeks, and the same PhaaS infrastructure may serve other customers — treat the IoCs as “used by this campaign,” not its fingerprint.
What to watch
Three things to watch: whether Microsoft and Google tighten device code authentication defaults; whether a new wave of fake pages piggybacks on AWS re:Invent in December; and the next set of lure brands — Push judges the operator “likely runs more lures than the ones we’ve seen.” The November 12 fake SpaceX briefing and the already-offline Anthropic page show themes rotating on a weekly cadence, so detection keyed to page behavior in the browser will outlast any domain list.