Fake OpenAI and SpaceX Event Invites Are a Trap for Work Microsoft and Google Logins
Security researchers caught fake registration pages for OpenAI, SpaceX and Anthropic events that ask employees to sign in with corporate accounts to claim AI rewards. Here is how the dual phishing platforms work and how to refuse the bait.
An invite to a free ChatGPT Pro month or a private SpaceX briefing looks like a perk. In a campaign spotted in late October, that perk was the hook for stealing Microsoft and Google work accounts—including sessions that can survive ordinary multifactor prompts.
The details come from BleepingComputer’s write-up of research by Push Security, which detected and blocked visits to the fake registration pages on customer browsers.
How the lure is built
- Victims reach a fake event page through shortened or trusted-looking links (Push notes Google and Zapier shorteners among others; earlier waves also abused GoTo Webinar mail or legitimate Zoom event pages).
- A Cloudflare-style CAPTCHA greets the visitor first, which slows automated scanners.
- The page copies the look of an OpenAI Academy livestream (“ChatGPT for Social & Digital Marketing Teams,” promising three months of ChatGPT Pro), a private SpaceX briefing on AI for marketing (November 12 in the observed copy, offering Grok Heavy time or a purported “SpaceX share”), or an Anthropic-themed AWS re:Invent lure that Push found already taken down.
- Registration claims to require a work account. Buttons offer “Continue with Microsoft” or “Continue with Google.”
Two PhaaS platforms, two paths
Microsoft path: The page uses the Kali365 phishing-as-a-service platform to start a legitimate-looking OAuth device-code flow. The visitor is told to copy a code and enter it on Microsoft’s real device-login site. Approving that request hands authentication tokens to the attacker’s Kali365 session—often without the victim typing a password on the fake page. Push says the flow then continues to a VoidProxy Microsoft sign-in page that can capture the password and session cookie as a second stage.
Google path: Choosing Google opens a VoidProxy adversary-in-the-middle reverse proxy of Google’s real sign-in. The platform sits between the browser and Google, collecting credentials, MFA responses and session cookies.
Push attributes the fake pages to custom kits tracked as ZoomMock and MSDRoot, with shared infrastructure suggesting the same operators. A successful Microsoft compromise can reach Entra-connected apps used through single sign-on; the Google path captures Google account sessions directly. Both paths are built to defeat or bypass common MFA checks by stealing an already-authenticated session or by using the device-code grant.
How to refuse the bait
- Do not enter Microsoft device codes that came from an event page, chat message or unexpected email—even if the next window shows a real microsoft.com address.
- Treat any “sign in with your work account to claim this reward” event as hostile until verified through a second channel.
- Where device-code authentication is not required for business, restrict or disable it in Entra / Microsoft 365.
- Prefer phishing-resistant MFA such as FIDO2 security keys for accounts that matter.
- Remind staff that premium AI trial offers and celebrity-brand briefings are classic lure themes right now.
What this means for your company
This campaign does not need malware on the laptop. It needs one curious employee and a login flow that feels official. Train people that device codes are credentials, review whether device-code auth is even needed in your tenant, and make sure a suspected account takeover triggers an immediate session revoke—not just a password change.
Want a quick review of your Microsoft 365 and Google Workspace sign-in policies, device-code settings and user coaching on event-invite phishing? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
