{"id":"CMP-202611-eeaanu","kind":"campaign","aliases":[],"related":[],"title":"Fake OpenAI, SpaceX and Anthropic event invitations steal Microsoft 365 and Google Workspace accounts, getting past MFA with device-code phishing (Kali365) and a reverse proxy (VoidProxy) (Push Security)","description":null,"summary":"Push Security reported on 5 Nov 2026 that it had blocked visits to fake event registration pages in late October 2026. The pages pose as an OpenAI Academy livestream ('ChatGPT for Social & Digital Marketing Teams', 4 Nov, reward: 3 months of ChatGPT Pro), an invite-only SpaceX 'Starship Product Briefing' on SpaceX AI for marketing and Grok (12 Nov, reward: 3 months of Grok Heavy or a 'SpaceX share'), and 'Anthropic at AWS re:Invent'. They mainly target marketing staff. Each page says a work account is required. 'Continue with Microsoft' starts a Microsoft device-code login through the Kali365 phishing service: the victim enters a code on the real microsoft.com device login page, which hands tokens to the attacker. The victim is then sent to a VoidProxy fake Microsoft sign-in that also captures the password and session cookie. 'Continue with Google' opens a VoidProxy reverse proxy of Google sign-in that captures the password, the MFA response and the session cookie. Both routes get past MFA. The same operator ran fake Zoom event pages from May to October 2026 (ZoomMock); the newer pages (MSDRoot) started on 22 Oct. Invitations arrive by email. Earlier waves came through GoTo Webinar's mail sender ('Austin from nthropic', reported by Cofense on 29 Oct) and real events.zoom.us pages (reported by ANY.RUN in July). The operator changes domains every few weeks. Victim count: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-05T21:57:39+00:00","products":[{"name":"Microsoft 365","fixed":[],"vendor":"Microsoft"},{"name":"Microsoft Entra ID","fixed":[],"vendor":"Microsoft"},{"name":"Google Workspace","fixed":[],"vendor":"Google"}],"ecosystems":[],"tags":["campaign","early-warning","phishing"],"not_affected_if":[],"how_to_check":"- Lure: an invitation to an OpenAI, SpaceX, Anthropic (or Meta/Zoom 'partner summit') event offering free ChatGPT Pro, Grok Heavy or a 'SpaceX share', that asks you to sign in with your work Microsoft or Google account. Sender seen in an earlier wave: 'Austin from nthropic' (the A is missing), sent through GoTo Webinar.\n- Links go through Google short links (c.gle, share.google), Zapier zpr.io, or an x.com/logout?redirect_after_logout= redirect, then a Cloudflare page saying 'Confirm you're not a robot'.\n- A 'Confirm access' box that shows a code and asks you to enter it on microsoft.com/devicelogin (login.microsoftonline.com/common/oauth2/deviceauth). This is the device-code attack.\n- Lure domains: eventrsvp[.]app (openai.eventrsvp[.]app, spacex.eventrsvp[.]app; path /event/.../id<11 digits>/rsvp/, /live/, /join/), rsvpconnect-events[.]com (anthropic.rsvpconnect-events[.]com, register.rsvpconnect-events[.]com).\n- Collection server: eventrsvp-217-60-102-48.sslip[.]io/collect.php, 217.60.102[.]48.\n- Sign-in proxies and backends: claudewebinnar[.]com (continue-to-event.claudewebinnar[.]com), continue-to-office-*.ggleventapi[.]icu, logins-offcevents[.]icu, accounts.ggkiejl[.]icu, wbdssologin[.]app, 62zr4vcasl.shifts[.]icu, ydgjgdbhoa.shifts[.]icu, rnacj.iceagelandforms[.]surf, clqzwd4jqw.emptytownmoon[.]de.\n- Older ZoomMock domains: us956web-zoom[.]us, us968web-zoom[.]us, ssomeetingportal[.]com, ssoeventportal[.]com, officegocrqb[.]com, offcevent-login[.]com, com-access-sharepoint[.]com, goo.gle-access-eventregister[.]icu, workportalsso[.]com, accounts.careersggl[.]icu, accounts.gfmzrsj[.]icu, accounts-auth.ggolshhk[.]icu.\n- Search proxy/DNS logs for these domains. In Entra ID sign-in logs, look for device-code sign-ins (authentication protocol deviceCode) by users who do not use devices without a keyboard. Kali365 has been seen registering a new device to the account right after compromise (user agent python-requests). Kali365 and VoidProxy hosts also serve other campaigns.","fix":"- Do not enter a code from a website or email on Microsoft's device login page, and do not sign in with your work account to 'claim' event rewards. Real OpenAI, SpaceX or Anthropic events do not require this.\n- Block the domains above at the proxy/DNS level.\n- Microsoft Entra ID: block the device code flow with Conditional Access (Authentication flows) for everyone who does not need it.\n- Use phishing-resistant MFA (FIDO2 security keys or passkeys) for Microsoft 365 and Google Workspace. Codes and push approvals are captured by these kits.\n- If someone signed in: revoke their sessions and refresh tokens, reset the password, remove any newly registered devices and MFA methods in Entra ID, check mailbox rules and OAuth app consents, and review Google Workspace sessions for that user.","status":"open","published_at":"2026-11-05T00:00:00+00:00","first_seen_at":"2026-11-05T21:57:39+00:00","triaged_at":"2026-11-05T21:57:39+00:00","updated_at":"2026-11-05T21:58:19+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':32A '12':108B '2026':56B,70B,234B '22':242B '29':264B '3':88B,111B '365':10A,39A '4':85B '5':54B 'academi':77B 'account':14A,136B 'ai':103B 'also':186B 'anthrop':5A,121B 'any.run':272B 'arriv':245B 'attack':171B 'austin':257B 'aw':123B 'block':60B 'brief':100B 'came':250B 'campaign':45B 'captur':187B,207B 'chang':277B 'chatgpt':79B,91B 'cmp':31A 'code':21A,147B,158B 'cofens':262B 'continu':139B,193B 'cooki':192B,216B 'count':283B 'devic':20A,146B,163B 'device-cod':19A,145B 'digit':82B 'domain':278B 'earli':47B 'earlier':248B 'early-warn':46B 'eeaanu':33A 'email':247B 'enter':156B 'entra':41A 'event':6A,64B,228B 'events.zoom.us':268B 'everi':279B 'fake':1A,63B,180B,226B 'get':15A,219B 'googl':12A,195B,202B 'google':43A 'goto':252B 'grok':107B,114B 'hand':167B 'heavi':115B 'id':42A 'invent':125B 'invit':7A,95B,244B 'invite-on':94B 'juli':274B 'kali365':23A,36A,151B 'late':68B 'livestream':78B 'login':148B,164B 'mail':255B 'main':127B 'market':83B,105B,129B 'may':231B 'mfa':17A,211B,221B 'microsoft':9A,38A,40A,141B,144B,181B 'microsoft.com':162B 'month':89B,112B 'msdroot':35A,239B 'newer':237B 'nov':55B,86B,109B 'nthropic':259B 'oct':243B,265B 'octob':69B,233B 'open':196B 'openai':2A,76B 'oper':224B,276B 'page':66B,72B,132B,165B,229B,238B,269B 'password':189B,209B 'past':16A,220B 'phish':22A,49B,152B 'pose':73B 'pro':92B 'product':99B 'proxi':27A,200B 'push':29A,50B 'ran':225B 're':124B 'real':161B,267B 'registr':65B 'report':52B,260B,270B 'requir':138B 'respons':212B 'revers':26A,199B 'reward':87B,110B 'rout':218B 'say':133B 'secur':30A,51B 'sender':256B 'sent':176B 'servic':153B 'session':191B,215B 'share':119B 'sign':183B,204B 'sign-in':182B,203B 'social':81B 'spacex':3A,97B,102B,118B 'staff':130B 'starship':98B 'start':142B,240B 'steal':8A 'target':128B 'team':84B 'token':168B 'unknown':284B 'victim':155B,173B,282B 'visit':61B 'voidproxi':28A,179B,198B 'voidproxy':37A 'warn':48B 'wave':249B 'webinar':253B 'week':281B 'work':135B 'workspac':13A 'workspace':44A 'zoom':227B 'zoommock':34A,235B","nicknames":["ZoomMock","MSDRoot","Kali365","VoidProxy"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["365","entraid","googleworkspace","kali365","microsoft365","microsoftentraid","msdroot","voidproxy","workspace","zoommock"],"ptokens":["365","entra","google","id","microsoft","workspace"],"labels":["campaign","earlywarning","high","other","phishing"],"campaign_type":"phishing","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-eeaanu","url":null,"severity":null,"published_at":"2026-11-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-05T21:57:39+00:00","fetched_at":"2026-11-05T21:57:39+00:00","note":null}],"documents":[{"id":77905,"url":"https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis","title":"Fake event invites combine Kali365 and VoidProxy payloads (Push Security)","kind":"blog","source":"blog","publisher":null,"text":"Push Security (Luke Jennings, 5 Nov 2026): fake OpenAI Academy, SpaceX and Anthropic at AWS re:Invent event registration pages, operator kits ZoomMock (May-Oct 2026) and MSDRoot (from 22 Oct 2026). Continue with Microsoft -> Kali365 device code phishing then VoidProxy Microsoft proxy; Continue with Google -> VoidProxy AiTM. Delivery via c.gle, share.google, zpr.io, x.com/logout?redirect_after_logout=, earlier GoTo Webinar mail and events.zoom.us. IOCs: eventrsvp[.]app, openai.eventrsvp[.]app, spacex.eventrsvp[.]app, rsvpconnect-events[.]com, anthropic.rsvpconnect-events[.]com, eventrsvp-217-60-102-48.sslip[.]io/collect.php, 217.60.102[.]48, 62zr4vcasl.shifts[.]icu, claudewebinnar[.]com, logins-offcevents[.]icu, accounts.ggkiejl[.]icu, ggleventapi[.]icu, wbdssologin[.]app, us956web-zoom[.]us, us968web-zoom[.]us, ssomeetingportal[.]com, ssoeventportal[.]com, officegocrqb[.]com, offcevent-login[.]com, com-access-sharepoint[.]com, gle-access-eventregister[.]icu, workportalsso[.]com, careersggl[.]icu, gfmzrsj[.]icu, ggolshhk[.]icu.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":80483,"url":"https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/","title":"BleepingComputer: Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts","kind":"blog","source":"blog","publisher":null,"text":"Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts\n\nHackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. [...]","published_at":"2026-11-05T21:30:30+00:00","relation":"describes","confidence":null,"note":null},{"id":80302,"url":"https://x.com/BleepinComputer/status/2118456017386185081","title":"@BleepinComputer: Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts\nhttps://t.co","kind":"post","source":"x","publisher":null,"text":"Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts\nhttps://t.co/2Gy3g1gpjg\n\nhttps://t.co/2Gy3g1gpjg\n\nlikes 9 reposts 0","published_at":"2026-11-05T21:30:48+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}