Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

A phishing campaign impersonates OpenAI, SpaceX, and Anthropic events to steal employees’ Microsoft and Google accounts. Fake registration pages promise rewards such as three months of ChatGPT Pro or Grok Heavy, or a SpaceX share, and require visitors to sign in with work accounts. Links may arrive through trusted URL-shortening services or legitimate webinar and event systems. A Cloudflare CAPTCHA helps the pages evade automated security checks. Researchers identified two custom page kits, ZoomMock and MSDRoot, that connect the lures to the Kali365 and VoidProxy phishing services.

The Microsoft flow uses Kali365 to generate a legitimate Microsoft device-authentication code. Victims enter the code on Microsoft’s real login site and approve access, letting attackers obtain authentication tokens without collecting a password at that stage. The page then redirects to a VoidProxy login that can capture the password and session cookie. For Google, VoidProxy proxies the login process to steal credentials, multifactor-authentication responses, and session cookies. These methods can bypass MFA or hijack authenticated sessions, potentially exposing connected services and applications. Employees should reject unfamiliar requests to enter device codes and be wary of event offers requiring corporate sign-in. Organizations can disable device-code authentication when unnecessary and adopt phishing-resistant MFA, such as FIDO2 security keys.