Fake OpenAI, SpaceX events target Microsoft and Google accounts

Hackers are using fake event invitations from OpenAI, SpaceX and Anthropic to lure employees to phishing pages that steal Microsoft and Google credentials or authentication sessions, according to a report by Push Security.

The pages offer rewards such as free access to premium AI services and require visitors to sign in with work accounts. Push Security says it detected and blocked visits to the pages in late October 2026. It found two custom kits, ZoomMock and MSDRoot, directing victims to phishing-as-a-service platforms Kali365 and VoidProxy. Researchers believe the same threat actors operate both kits, citing shared infrastructure and targeting.

A fake OpenAI event called “ChatGPT for Social & Digital Marketing Teams” promises three months of ChatGPT Pro. A fake private SpaceX event on November 12 offers three months of Grok Heavy or a “SpaceX share.” Researchers also found a page impersonating an Anthropic event at AWS re:Invent 2026; it had been taken down.

The pages show “Continue with Microsoft” and “Continue with Google.” Selecting Microsoft prompts a device authentication code that victims are told to enter on Microsoft's legitimate login site. This can let Kali365 obtain Microsoft authentication tokens without the victim giving it a password. The Google option opens a login pop-up provided through VoidProxy. Push Security says both services can bypass multifactor authentication by capturing an authenticated session, while device code phishing can bypass it entirely.

Push Security says the links’ initial distribution is unclear. It found redirects through trusted services, including Google and Zapier URL shorteners. Earlier versions also used GoTo Webinar email systems or legitimate Zoom event pages.