Event-Invite Phishing Targets Corporate Sign-Ins
Researchers at Push Security report a campaign using fake event invitations impersonating OpenAI, SpaceX and Anthropic to lure employees into signing in with corporate accounts. Two phishing-as-a-service (PhaaS) platforms steal Microsoft and Google credentials and authentication sessions. Push detected and blocked visits to the pages in late October 2026.
The Lures
- An OpenAI event, "ChatGPT for Social & Digital Marketing Teams," offering three months of ChatGPT Pro
- A private SpaceX event on November 12 offering three months of Grok Heavy or a "SpaceX share"
- A fake Anthropic event tied to AWS re:Invent 2026, since taken down
Victims are told they must sign in with a work account to register and claim the reward.
Tooling
| Component | Role |
|---|---|
| ZoomMock and MSDRoot | Custom kits that build the fake event pages, likely run by the same actors |
| Kali365 | PhaaS platform performing Microsoft device code phishing |
| VoidProxy | PhaaS adversary-in-the-middle (AiTM) reverse proxy for Google sign-ins, and a second stage for Microsoft attacks |
Attack Chain
- Victims are redirected through trusted services, including Google and Zapier URL shorteners.
- A Cloudflare CAPTCHA blocks automated security scanners.
- Continue with Microsoft triggers a Kali365 device code that the victim enters on Microsoft's real login page, then redirects to a VoidProxy login page.
- Continue with Google opens a VoidProxy AiTM pop-up that proxies the real login and captures passwords, MFA responses and session cookies.
Both paths can bypass MFA, either by stealing an authenticated session or, with device code flow, by avoiding the MFA prompt entirely. The initial delivery method is unclear. Earlier versions used GoTo Webinar email systems or legitimate Zoom event pages. ANY.RUN documented a similar Zoom-based campaign in July, and Cofense reported Anthropic-themed invitations sent through GoTo Webinar.
Defensive Guidance
- Never enter a Microsoft device code supplied by an unfamiliar site.
- Be suspicious of event invitations that require a corporate sign-in to claim a prize.
- Restrict device code flow with Conditional Access where it is not needed.
- Deploy phishing-resistant MFA (FIDO2 security keys or passkeys), which resists session hijacking.
- Hunt for unusual device code sign-ins and new sessions from unfamiliar IPs in Entra and Google Workspace logs.