ZoomMock: Fake OpenAI, SpaceX and Anthropic event invitations steal Microsoft 365 and Google Workspace accounts, getting past MFA with device-code phishing (Kali365) and a reverse proxy (VoidProxy) (Push Security)

Push Security reported on 5 Nov 2026 that it had blocked visits to fake event registration pages in late October 2026. The pages pose as an OpenAI Academy livestream ('ChatGPT for Social & Digital Marketing Teams', 4 Nov, reward: 3 months of ChatGPT Pro), an invite-only SpaceX 'Starship Product Briefing' on SpaceX AI for marketing and Grok (12 Nov, reward: 3 months of Grok Heavy or a 'SpaceX share'), and 'Anthropic at AWS re:Invent'. They mainly target marketing staff. Each page says a work account is required. 'Continue with Microsoft' starts a Microsoft device-code login through the Kali365 phishing service: the victim enters a code on the real microsoft.com device login page, which hands tokens to the attacker. The victim is then sent to a VoidProxy fake Microsoft sign-in that also captures the password and session cookie. 'Continue with Google' opens a VoidProxy reverse proxy of Google sign-in that captures the password, the MFA response and the session cookie. Both routes get past MFA. The same operator ran fake Zoom event pages from May to October 2026 (ZoomMock); the newer pages (MSDRoot) started on 22 Oct. Invitations arrive by email. Earlier waves came through GoTo Webinar's mail sender ('Austin from nthropic', reported by Cofense on 29 Oct) and real events.zoom.us pages (reported by ANY.RUN in July). The operator changes domains every few weeks. Victim count: unknown.