Fake OpenAI and SpaceX event pages steal Microsoft and Google accounts

Push Security reports that the attackers use convincing event registration pages offering free access to premium AI services and other rewards. Visitors are told they must sign in with their work accounts to register and claim the rewards. The pages integrate two phishing-as-a-service platforms, Kali365 and VoidProxy. Kali365 runs Microsoft device code phishing, while VoidProxy acts as an adversary-in-the-middle reverse proxy that intercepts Google sign-ins and steals authentication session cookies. The Microsoft attack also uses VoidProxy as a second stage.

The phishing pages impersonate events hosted by OpenAI, SpaceX and Anthropic. One advertises an OpenAI event offering three months of ChatGPT Pro, another a private SpaceX event on November 12 offering either three months of Grok Heavy or a "SpaceX share". Push Security says it detected and blocked visits to the malicious pages in late October 2026. The researchers believe the same threat actors operate the two custom phishing kits, ZoomMock and MSDRoot, which use shared infrastructure and the same targeting.

Why it matters Employees may treat event invitations that ask for corporate sign-in as routine, so these lures can reach accounts that carry access to email and cloud resources. Device code requests should be treated as suspicious when they come from unfamiliar websites, and organizations that do not need device code authentication may restrict it. Phishing-resistant MFA, such as FIDO2 security keys, reduces the risk of session hijacking. Investigators should check for device code grants and unusual session cookies tied to Microsoft and Google accounts.