Fake OpenAI and SpaceX events used to steal Microsoft and Google accounts

A sophisticated phishing campaign has been uncovered where attackers are using fake invitations to high-profile AI and space industry events to compromise corporate accounts. Security researchers report that the campaign is effectively leveraging PhaaS (Phishing-as-a-Service) platforms to bypass standard security measures.

• Attackers use fake registration pages for OpenAI, SpaceX, and Anthropic events to steal credentials.
• Kali365 and VoidProxy platforms are employed to perform session hijacking and OAuth token theft.
• Campaigns use trusted URL shorteners like Google and Zapier to distribute malicious links.
• The phishing kits allow attackers to bypass multi-factor authentication (MFA) entirely.

Anatomy of the Phishing Attack The threat actors create highly convincing event websites promising exclusive perks, such as free ChatGPT Pro subscriptions or SpaceX shares. These sites employ Cloudflare CAPTCHA challenges to appear legitimate and deter automated security scanners. Victims are directed to sign in with their work accounts to "register" for these fictitious events. When a victim selects "Continue with Microsoft," the site triggers a device code authentication attack. This exploits the OAuth 2.0 device authorization flow, allowing the attacker to intercept authentication tokens. Once stolen, these tokens grant the attacker persistent access to the victim's resources, including Microsoft 365, Slack, and Zendesk, without needing the user's password.

Advanced Session Hijacking For users attempting to sign in with Google, the attackers use the VoidProxy platform. This method captures an already authenticated session, effectively rendering traditional password and MFA protections useless. By grabbing the active session, the attackers can maintain access to the user's workspace, circumventing security alerts that usually trigger upon a new login attempt from an unknown device.

Protecting Corporate Infrastructure This campaign highlights the evolving nature of session-hijacking attacks that target organizations globally. For businesses and IT administrators, the primary defense is to restrict device code authentication flows where not strictly necessary and to enforce phishing-resistant MFA, such as FIDO2 hardware security keys. Security teams should monitor for suspicious authentication patterns and educate employees on verifying the source of any event invitations requiring corporate credentials. As these campaigns become more targeted, vigilance remains the most effective tool in preventing account takeovers and data breaches.