Fake OpenAI, SpaceX, Anthropic event invites phish Microsoft and Google accounts via Kali365, VoidProxy
Attackers are impersonating OpenAI, SpaceX, and Anthropic events to trick employees into authenticating with corporate Microsoft and Google accounts, according to a report from Push Security. The phishing pages, built with two custom kits tracked as ZoomMock and MSDRoot, offer fake rewards such as free ChatGPT Pro or Grok Heavy access to lure victims into signing in, then route them to one of two rented phishing-as-a-service (PhaaS) platforms depending on the chosen identity provider. Push Security detected and blocked visits to these pages in late October 2026, and the campaign appears to build on an earlier wave reported by ANY.RUN in July 2026 that abused legitimate Zoom event pages, as well as emails impersonating Anthropic invitations distributed through GoTo Webinar's infrastructure reported by Cofense.
Detalhes técnicos
Visitors choosing "Continue with Microsoft" are routed to Kali365, which abuses the legitimate OAuth 2.0 device authorization grant flow: the victim is told to enter a device code on Microsoft's real login page, letting attackers obtain authentication tokens without ever seeing the password, and entirely bypassing MFA. After that step, the Microsoft flow redirects victims to a VoidProxy page as a second stage to additionally capture the password and session cookie. Victims choosing "Continue with Google" are instead sent directly into a VoidProxy adversary-in-the-middle (AiTM) proxy that sits between the browser and Google's real login page, intercepting credentials, MFA responses, and session cookies. Stolen Microsoft Entra tokens can grant access to connected SSO applications including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian. A Cloudflare CAPTCHA is shown before the fake registration page to block automated scanning tools, and lures were distributed via trusted Google and Zapier URL shorteners, as well as, in earlier versions, GoTo Webinar emails and legitimate Zoom event pages. Researchers assess the same threat actor likely operates both ZoomMock and MSDRoot kits based on shared infrastructure and targeting.
Remediação
Employees should avoid entering Microsoft device authentication codes supplied by unfamiliar websites and treat event invitations requiring a corporate sign-in to claim rewards with suspicion. Organizations are advised to restrict device code authentication where it is not operationally needed and deploy phishing-resistant MFA such as FIDO2 security keys to reduce exposure to session hijacking.
Linha do tempo
-
Fake OpenAI, SpaceX, Anthropic event invites phish Microsoft and Google accounts via Kali365, VoidProxy
ler a análise desta fonte ocultar
Attackers are impersonating OpenAI, SpaceX, and Anthropic events to trick employees into authenticating with corporate Microsoft and Google accounts, according to a report from Push Security. The phishing pages, built with two custom kits tracked as ZoomMock and MSDRoot, offer fake rewards such as free ChatGPT Pro or Grok Heavy access to lure victims into signing in, then route them to one of two rented phishing-as-a-service (PhaaS) platforms depending on the chosen identity provider. Push Security detected and blocked visits to these pages in late October 2026, and the campaign appears to build on an earlier wave reported by ANY.RUN in July 2026 that abused legitimate Zoom event pages, as well as emails impersonating Anthropic invitations distributed through GoTo Webinar's infrastructure reported by Cofense.
Technical Details
Visitors choosing "Continue with Microsoft" are routed to Kali365, which abuses the legitimate OAuth 2.0 device authorization grant flow: the victim is told to enter a device code on Microsoft's real login page, letting attackers obtain authentication tokens without ever seeing the password, and entirely bypassing MFA. After that step, the Microsoft flow redirects victims to a VoidProxy page as a second stage to additionally capture the password and session cookie. Victims choosing "Continue with Google" are instead sent directly into a VoidProxy adversary-in-the-middle (AiTM) proxy that sits between the browser and Google's real login page, intercepting credentials, MFA responses, and session cookies. Stolen Microsoft Entra tokens can grant access to connected SSO applications including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian. A Cloudflare CAPTCHA is shown before the fake registration page to block automated scanning tools, and lures were distributed via trusted Google and Zapier URL shorteners, as well as, in earlier versions, GoTo Webinar emails and legitimate Zoom event pages. Researchers assess the same threat actor likely operates both ZoomMock and MSDRoot kits based on shared infrastructure and targeting.
Remediation
Employees should avoid entering Microsoft device authentication codes supplied by unfamiliar websites and treat event invitations requiring a corporate sign-in to claim rewards with suspicion. Organizations are advised to restrict device code authentication where it is not operationally needed and deploy phishing-resistant MFA such as FIDO2 security keys to reduce exposure to session hijacking.