Fake AI events chain two phishing kits

A phishing campaign is borrowing the names of the most-hyped companies in technology — OpenAI, SpaceX, and Anthropic — and using them as the front door to corporate Microsoft and Google accounts. According to a new report from Push Security, the operation pairs convincing event registration pages offering free access to premium AI services with two separate phishing-as-a-service platforms working in tandem.

What sets this campaign apart is not the lure, which follows a well-worn playbook, but the plumbing behind it. The same registration page can steer a Microsoft user into a device code phishing flow and a Google user into an adversary-in-the-middle proxy, with a second platform waiting to catch credentials and session cookies after the first one succeeds.

Two kits, one campaign

Push Security says the attackers built two custom phishing kits, tracked as ZoomMock and MSDRoot, to create fake event pages that then hand victims off to the Kali365 and VoidProxy phishing services. The researchers believe the same threat actors operate both kits because they share infrastructure and the same targeting.

The division of labor is deliberate. Kali365 handles Microsoft device code phishing, while VoidProxy operates as an adversary-in-the-middle reverse proxy for Google sign-ins, intercepting authentication session cookies as they are issued. For Microsoft targets, VoidProxy is not a parallel option but a second stage, deployed after Kali365 has already obtained authentication tokens.

The campaign impersonates events hosted by OpenAI, SpaceX, and Anthropic, with registration pages built to resemble legitimate event websites. The researchers also found one page impersonating an Anthropic event at AWS re:Invent 2026, which was already taken down by the time Push Security documented it.

The rewards on offer

The lures are specific enough to feel plausible to a busy employee. One page advertises an OpenAI event titled “ChatGPT for Social & Digital Marketing Teams,” promising three months of ChatGPT Pro to participants. Another promotes a private SpaceX event on November 12, offering registrants either three months of Grok Heavy or a “SpaceX share.”

The registration pages tell visitors they must sign in with their work accounts to register and claim the advertised rewards. That instruction is the pivot point of the entire attack: it converts a curiosity click into a corporate authentication event.

Push Security says it detected and blocked visits to the malicious event registration pages in late October 2026. The campaign is not the first to use this formula. ANY.RUN documented a similar effort in July, when attackers abused legitimate Zoom event pages to promote fake Meta, OpenAI, and Anthropic events that led to device code and AiTM phishing attacks. Cofense also recently reported on phishing emails impersonating Anthropic event invitations that were distributed through GoTo Webinar's email infrastructure and redirected recipients through multiple websites to fake registration pages.

Trusted links as camouflage

It is unclear how the attackers initially distribute the phishing links, but Push Security found that they redirect victims to the malicious registration page using links from trusted services, including Google and Zapier URL shorteners. Invitations from earlier versions of the campaign were also distributed through GoTo Webinar's email systems or legitimate Zoom event pages.

The choice of redirectors matters because it places a reputable domain between the recipient and the payload. A link that begins on a familiar shortener or webinar platform does not look like the start of a credential theft attempt, and mail filters may treat it differently than an unfamiliar domain.

Before displaying the fake registration page, the websites show a Cloudflare CAPTCHA asking visitors to confirm they are not a robot. The researchers say this step prevents automated security platforms from scanning the phishing site — a reminder that the same anti-automation controls legitimate sites use are now a standard part of phishing infrastructure.

Continue with Microsoft

Once visitors reach the event registration page, they are presented with two options: “Continue with Microsoft” and “Continue with Google.” Choosing Microsoft sets off a device code phishing attack, in which the page contacts the Kali365 platform to generate a Microsoft device authentication code.

Device code phishing abuses the legitimate OAuth 2.0 device authorization grant flow to obtain authentication tokens for the victim's Microsoft Entra account. The visitor is instructed to copy the code and enter it on Microsoft's legitimate device login website, where they authenticate and approve the request. That approval lets the Kali365 platform capture Microsoft authentication tokens without the victim ever typing a password into the phishing page.

The tokens can then be used to reach the user's resources and connected SSO applications, including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian. Device code phishing has been used in the past for data theft and cyberespionage attacks.

After the device code authentication succeeds, the page redirects the victim to a VoidProxy Microsoft login page, where attackers can also capture the victim's password and session cookie. The device code flow gets them tokens; the follow-up page gets them the rest.

Google sign-ins behind a proxy

Choosing the Google authentication option opens a pop-up containing a Google login page served by the VoidProxy PhaaS. The platform operates as an adversary-in-the-middle proxy, sitting between the victim's browser and Google's login page, proxying the login forms, and stealing credentials, MFA responses, and session cookies as they pass through.

Because the victim interacts with what appears to be a genuine Google login page, the proxy captures a session that is already authenticated — including any multifactor response the user completes. Both the Kali365 and VoidProxy platforms let attackers bypass multifactor authentication, either by capturing an already authenticated session or, in the case of device code authentication, bypassing MFA entirely.

The Push Security analysis, which describes the infrastructure and targeting in detail, treats the two kits as a single operation rather than unrelated campaigns. The shared infrastructure and identical targeting are the stated basis for that conclusion.

Where defenders can intervene

The guidance that follows from the report is narrow and practical. Employees should avoid entering Microsoft device authentication codes provided by unfamiliar websites, and should be cautious of event invitations that require signing in with corporate accounts to claim rewards. The instruction to authenticate before receiving a prize is the common thread across the OpenAI, SpaceX, and Anthropic pages.

Organizations can restrict device code authentication where it is not needed, closing off the token-capture route Kali365 relies on. They can also deploy phishing-resistant MFA such as FIDO2 security keys to help prevent session hijacking, since a proxy that captures a session cookie is less useful against an authentication method that cannot be relayed the same way.

The campaign's reliance on trusted redirectors and Cloudflare challenges means automated scanning will not always flag the registration pages before an employee reaches them. That places more of the detection burden on the sign-in flow itself — what a user is asked to approve and where.

The invitation as attack surface

The broader pattern here is that the event invitation, a mundane artifact of corporate life, has become a delivery mechanism for authentication attacks. The lures change with the news cycle — fake Meta and OpenAI events in July, Anthropic invitations through webinar infrastructure, and now a SpaceX event with a stock-share reward — but the mechanics underneath are consistent: a trusted-looking page, a request to sign in with a work account, and a platform that converts that sign-in into tokens or a session cookie.

For businesses, the practical consequence is that the value of a stolen session now exceeds the value of a stolen password. The Microsoft path never asks the victim to type a password into the phishing page, and the Google path captures the session after MFA is satisfied. Controls built around password hygiene alone do not address either flow.

For employees, the report's examples show how specific the pretexts have become: named events, named rewards, and registration pages that mimic real conference sites. The safest reading of an invitation that offers premium AI access in exchange for a corporate sign-in is that the reward is the bait, not the point.