A phishing campaign is impersonating OpenAI, SpaceX and Anthropic to trick employees into handing over access to their Microsoft and Google work accounts, according to a new report from security firm Push Security.
The scheme uses convincing fake event registration pages that dangle rewards such as free premium AI subscriptions. Push Security says it detected and blocked visits to these malicious pages on its customers’ browsers in late October 2026.
One fake page advertised a November 4 livestream called “ChatGPT for Social & Digital Marketing Teams,” purportedly from OpenAI, offering three months of ChatGPT Pro to anyone who registered. Another impersonated an invitation-only SpaceX briefing scheduled for November 12, offering three months of Grok Heavy or a “SpaceX share.” A third page impersonated an Anthropic event tied to AWS re 2026, though it was no longer active when researchers investigated. Push Security did not suggest that OpenAI, SpaceX or Anthropic were actually running these events.
To register and claim the advertised rewards, visitors are told they must sign in using their corporate Microsoft or Google account — the step that opens the door to the attack.
How the scam disguises itself
The attackers route visitors through shortened links associated with Google and Zapier, and earlier related campaigns used legitimate Zoom and GoTo Webinar infrastructure to make the invitations look credible. Victims then face a Cloudflare security challenge, the kind of “prove you’re human” check common on legitimate sites, which here also helps block automated security scanners from examining the pages.
After passing the check, visitors reach what looks like a polished event registration site with two buttons: “Continue with Microsoft” and “Continue with Google.” Each triggers a different attack method.
The Microsoft route
Clicking “Continue with Microsoft” connects to a phishing-as-a-service platform called Kali365, which generates a real Microsoft device authentication code. The fake page tells the visitor to copy that code onto Microsoft’s actual sign-in site. Because the attacker initiated the authentication request, approving it hands Microsoft-issued tokens to the attacker — no password needed. Push Security found the campaign then redirects victims to a second phishing service, VoidProxy, which attempts to capture passwords and session cookies, potentially exposing Microsoft 365 email, documents and other connected workplace apps.
The Google route
Clicking “Continue with Google” opens a pop-up resembling Google’s sign-in screen, but the process runs through VoidProxy acting as a middleman with Google’s real authentication service. This lets the phishing operation capture credentials, intercept some multifactor authentication responses, and steal session cookies — the data that keeps a user logged in without re-entering a password. A stolen session cookie can let an attacker reuse an authenticated session without ever completing a normal login.
Push Security documented the infrastructure and blocked visits to the phishing pages but did not determine how many accounts, if any, were successfully compromised.
Who’s behind it
Researchers identified two phishing kits used to build the fake event pages, which they call ZoomMock and MSDRoot, and found evidence — though not conclusive — suggesting the same operators built both. They found no evidence linking the developers of Kali365 and VoidProxy, and believe the event-campaign operators are simply customers of both services. The fake pages can also automatically display content in a visitor’s language, letting the same campaign target people in different regions without building new sites.
A Microsoft spokesperson said:
You must be logged in to post a comment Login