Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

Fake OpenAI SpaceX events disclosed that a credential was leaked, exposing a trust relationship that could have been abused.

Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions.

According to a new report from Push Security, the attackers use convincing event registration pages offering free access to premium AI services and other rewards to trick victims into signing in with their corporate accounts.

The campaign comes after a similar campaign documented by ANY.RUN in July, when attackers abused legitimate Zoom event pages to promote fake Meta, OpenAI, and Anthropic events that led to device code and AiTM phishing attacks.

Cofense also recently reported on phishing emails impersonating Anthropic event invitations that were distributed through GoTo Webinar's email infrastructure and redirected recipients through multiple websites to fake registration pages.

While it is unclear how the attackers initially distribute the phishing links, Push Security found that they redirect victims to a malicious event registration page using links from trusted services, including Google and Zapier URL shorteners.

Anyone connected to Fake OpenAI SpaceX events through the compromised trust relationship is potentially affected, not just Fake OpenAI SpaceX events itself.

What makes the attacks interesting is that the same phishing pages integrate two separate phishing-as-a-service (PhaaS) platforms, Kali365 and VoidProxy, to target Microsoft and Google accounts using different authentication attacks.

Invitations from earlier versions of the campaign were also distributed through GoTo Webinar's email systems or legitimate Zoom event pages.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Push Security says the attackers use two custom phishing kits, tracked as ZoomMock and MSDRoot, to create fake event pages that then direct victims to the Kali365 and VoidProxy phishing services.

When victims select the Microsoft option, the phishing page contacts the Kali365 platform to generate a Microsoft device authentication code.

The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.

A device code phishing attack occurs when an attacker abuses the legitimate OAuth 2.0 device authorization grant flow to obtain authentication tokens for the victim's Microsoft Entra account.

This allows the Kali365 phishing platform to steal Microsoft authentication tokens without requiring the victim to disclose their password directly.

Fake OpenAI SpaceX events says the credential has been revoked, and no exploitation has been confirmed so far.

Push Security says it detected and blocked visits to the malicious event registration pages in late October 2026.

If you have any integration or dependency involving Fake OpenAI SpaceX events, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

To protect against these attacks, employees should avoid entering Microsoft device authentication codes provided by unfamiliar websites and be cautious of event invitations that require signing in with corporate accounts to claim rewards.