# Fake OpenAI, SpaceX and Anthropic Event Invites Are Stealing Microsoft and Google Logins

> Source: <https://explainx.ai/blog/fake-openai-spacex-anthropic-event-invites-kali365-voidproxy-device-code-phishing-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog>
> Published: 2026-11-12 00:00:00+00:00

**Attackers are sending fake event invitations that borrow the names of OpenAI, SpaceX and Anthropic, and the pages steal Microsoft and Google work logins even when multi-factor authentication is on.** Push Security published the analysis on November 5, 2026, and [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/?ref=explainx) and [TechRadar](https://techradar.com/pro/security/hackers-use-fake-openai-spacex-and-anthropic-event-invites-in-new-phishing-scam-to-steal-microsoft-and-google-accounts?ref=explainx) followed. The lures promise free AI subscriptions. The real prize is a session on your company's Microsoft 365 or Google Workspace tenant.

The three AI brands are bait, not victims. No OpenAI, SpaceX or Anthropic system is reported breached. If your job puts you near marketing, sales or any team that likes free AI credits, this is the kind of invitation you will see.

## TL;DR

| Question | Answer | 
|---|---|
| Who found it | Push Security, report dated Nov 5, 2026 | 
| Lures | OpenAI Academy livestream (Nov 4), private SpaceX "Starship Product Briefing" (Nov 12), Anthropic event at AWS re:Invent | 
| Bait | 3 months of ChatGPT Pro, 3 months of Grok Heavy, or a "SpaceX share" | 
| Tools | Kali365 (Microsoft device code phishing) and VoidProxy (reverse proxy for Google and Microsoft) | 
| Why MFA fails | The proxy relays the MFA answer, and device code phishing never asks for a password | 
| Best defense | Phishing-resistant MFA plus a block on the device code flow | 
| Victim count | Not published | 

## What Push Security found

In late October 2026, Push says it detected and blocked visits to fake event registration pages on customer browsers. Each page advertised an event tied to a famous AI name. According to [Push's write-up](https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis?ref=explainx), the lures were:

- An **OpenAI Academy** livestream dated November 4.
- A private **SpaceX** "Starship Product Briefing" on AI for marketing and Grok, dated November 12.
- An **Anthropic** event tied to AWS re:Invent 2026. BleepingComputer notes this page was already taken down when researchers found it.

Every page asked visitors to sign in with a work account to claim a reward: three months of ChatGPT Pro, three months of Grok Heavy, or a "SpaceX share". Push also saw a leftover reference to Claude inside the OpenAI page code. That suggests the operator clones one template and does not rebrand it fully.

The timeline is short. Push says the operator moved from Zoom-themed lures to Anthropic, OpenAI, SpaceX and Claude lures between October 20 and 30. The `eventrsvp` domain Push traced was three days old when the researchers investigated it on November 2. New domains appear fast, so a blocklist of today's addresses will age quickly.

## How the attack works, step by step

Push describes a four-stage flow. Understanding each stage shows why common advice such as "check for the padlock" fails here.

**1. The invitation.** Victims reach the page through links on trusted services. Push lists Google short links, Zapier's `zpr.io` and an x.com logout redirect. The report says earlier waves used GoTo Webinar's mail sender or real `events.zoom.us` pages. The initial delivery method for the newest wave is unclear in the reporting. The common trick is that the first link in the chain belongs to a brand the mail filter trusts.

**2. The bot check.** A Cloudflare managed challenge titled "Confirm you're not a robot" sits in front of the lure. Humans click through. Automated scanners stop there and see nothing harmful. Push adds that the proxies show scanners legitimate news sites.

**3. The event page.** The page looks like an ordinary registration form with two buttons: "Continue with Microsoft" and "Continue with Google". Each step is reported to the operator's collection server.

**4. The payload.** The button decides what happens next.

- **Microsoft button:** The page runs a**Kali365** device code flow. It shows a code and a "Confirm access" dialog. The victim types the code on Microsoft's real device login page. That approves a sign-in session the attacker already opened, and Microsoft hands tokens to the attacker. The page then redirects to a**VoidProxy** Microsoft sign-in page that can also capture the password and session cookie.
- **Google button:** A pop-up shows a VoidProxy reverse proxy of Google's real sign-in page. The proxy sits between the victim and Google, so it captures the password, the MFA response and the session cookie. This is an adversary-in-the-middle (AiTM) attack.

The two paths use different tricks, and a defense that stops one may miss the other. That is the main lesson of the report.

## The two phishing-as-a-service tools

**Kali365** performs Microsoft device code phishing. It abuses the OAuth 2.0 device authorization grant, a legitimate flow built for devices without a keyboard, such as a smart TV. BleepingComputer notes the stolen tokens can reach connected single sign-on apps such as Microsoft 365, Salesforce and Google Workspace. Push has also published a [Kali365 threat page](https://pushsecurity.com/threat-intelligence/kali365?ref=explainx).

**VoidProxy** is a reverse proxy for Google sign-ins and a second stage for Microsoft. It relays every request to the real site and records what passes through. The page looks right because most of it is right.

Both are rented as services. The operator does not need to build token-theft code, only a believable lure. Push names the operator's own kits **ZoomMock** (seen from May to October 2026) and **MSDRoot** (from October 22). It rates the link between them as medium-high confidence, based on one shared domain, a repeated Cloudflare challenge page, similar targeting of marketing staff and similar proxy naming. It found no link between the developers of Kali365 and VoidProxy and suspects the operator is a customer of both.

## Why AI brands make good bait

Free AI access is a strong hook right now. Many employees want ChatGPT Pro or Grok Heavy and cannot expense it. A "SpaceX share" is an odd reward, and it still appears in the lure text. The pattern is not new. Push, citing ANY.RUN, points to a July 15 campaign that used real Zoom event pages to promote fake Meta, OpenAI and Anthropic events. It also cites Cofense, which reported on October 29 phishing mails that impersonated Anthropic event invitations through GoTo Webinar.

The same logic drives scams outside company logins. Our coverage of the [DOJ case on AI impersonation fraud](https://explainx.ai/blog/doj-indicts-three-ai-impersonation-ceo-lawyer-fraud-129-million-2026) and the [Mark Cuban deepfake scam ads](https://explainx.ai/blog/mark-cuban-facebook-ai-deepfake-diabetes-scam-ads-16-billion-meta-documents-claimed-vs-verified-2026) show attackers borrowing trusted faces and brands. Here the borrowed thing is the AI lab's name. Expect more of it as launches and events pile up. For a wider view of what is hitting teams this month, see our [November 2026 cyberattacks tracker](https://explainx.ai/blog/november-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026).

## Why MFA does not save you here

Many staff believe MFA makes a stolen password harmless. These two paths show the limits.

- **Adversary-in-the-middle.** The proxy forwards your MFA code to the real site in real time. The site accepts it, issues a session cookie, and the proxy keeps a copy. The attacker then replays the cookie. They never needed to guess the code.
- **Device code phishing.** No password is stolen at all. You approve the attacker's session yourself, on a genuine Microsoft page. A passkey does not help, because the check happens on the real site and succeeds.

A phishing-resistant method such as a FIDO2 security key or a passkey binds the sign-in to the real domain. That blocks the proxy path, because the key refuses to answer for a look-alike address. It does not block the device code path by itself. Coverage of the Push report notes that a passkey stops the VoidProxy branch but not the device code branch. You need the second control too.

## What to do now

Push's own advice is short: hunt your logs for the indicators it lists, and use browser-layer controls that warn on or block device code login pages. Those are Push product features, so treat them as one option. Add these steps that any team can take.

**For employees**

1. Treat any event that requires a work login to claim a prize as hostile. Real events use a plain registration form.
2. Never type a code into a Microsoft page because another site told you to. A real code request comes from a device you started.
3. Go to the event through the lab's own site, not through an email link or a shortened URL.
4. If you already entered a code or signed in, report it at once. Do not wait to see if something breaks.

**For administrators**

1. Block the device code flow with a Conditional Access policy for everyone who does not need it. Allow it only for named devices.
2. Require phishing-resistant MFA for finance, admin and executive accounts first.
3. Search sign-in logs for device code grants from new locations, and for new session tokens soon after a sign-in. Revoke refresh tokens for any account you suspect.
4. Review OAuth app consents and sessions. Stolen tokens can reach connected apps through single sign-on.
5. Push cautions that these domains rotate and may be shared by other customers of the services, so a domain list helps only for looking back.

If a stolen session was used to drive an AI agent or coding tool in your tenant, the damage can spread beyond mail and files. [AgentBeam](https://agentbeam.com/?ref=explainx), the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions, and it is one way to limit what a hijacked account can make an agent do. For a related look at identity and agent risk, read our post on [banks detecting unauthorized AI agents on customer accounts](https://explainx.ai/blog/banks-detect-unauthorized-ai-agents-customer-accounts-axios-reuters-what-is-confirmed-2026).

## What is confirmed and what is not

**Confirmed by the primary report:** the fake pages, the lure names and dates, the use of Kali365 and VoidProxy, the Cloudflare challenge, the redirect services, the timeline between October 20 and 30, and Push's medium-high link between the two custom kits.

**Not published:** the number of victims, the number of companies hit, the identity of the operator, and how the newest invitations are delivered. Push detected and blocked visits on its own customers' browsers, so the report describes what Push saw, not the full campaign. BleepingComputer gives November 5 for the report and one other outlet says November 6, so check Push's post for the exact date before you quote it.

**Not a breach:** OpenAI, SpaceX and Anthropic did not lose data in this campaign. If you see a statement saying so, it is wrong. Check each lab's own channels if you are unsure whether an event is real.

## How this fits the wider pattern

AI labs now hold two roles in attacks. They are the brands that attackers copy, as here. They are also the source of tools attackers and defenders use. We covered one side in [NEAR AI's inference breach and TEE claims](https://explainx.ai/blog/near-ai-cloud-inference-breach-tee-november-2026). The common thread is simple. Identity is the soft spot. A fake page needs no software flaw when a person can be talked into approving a login.

The practical takeaway: assume an AI-themed invitation with a login button is a lure until you confirm it on the lab's own site. Then close the two gaps this campaign uses. Move high-risk accounts to phishing-resistant MFA, and turn off the device code flow where nobody needs it.

## Related reading

*This post reflects reporting available on November 12, 2026. Details may change as Push Security and others publish more.*