OpenAI and SpaceX: fake events steal Microsoft and Google sessions

Push Security says a live lure is dressed up as a conference invite. Registration pages impersonate events from OpenAI, SpaceX, and Anthropic, then ask the visitor to continue with a work Microsoft account or a work Google account. BleepingComputer reported the research on November 5, 2026. The firm says it detected and blocked visits to the pages in late October.

The prize on the page is the bait. One OpenAI-branded event, aimed at social and digital marketing teams, offered three months of ChatGPT Pro. A SpaceX page promoted a private event on November 12 and offered three months of Grok Heavy or a “SpaceX share.” A third page borrowed an Anthropic event at AWS re:Invent 2026. That one was already down when researchers looked. Each page tells the visitor that a work login is how they register and claim the reward.

Two kits, one invite

Push Security tracks the fake event sites as two kits, ZoomMock and MSDRoot, and reads them as one operation: shared infrastructure, same targets. The pages then hand the sign-in to two phishing-as-a-service platforms. Kali365 handles the Microsoft path. VoidProxy handles Google, and it also sits behind a second Microsoft step.

On the Microsoft path, the page obtains a device-code sign-in for the employee’s Entra account. Approving that code can give the operator a token without the password being typed into the fake site. The flow then continues onto a VoidProxy Microsoft page that can still collect the password and the session. On the Google path, VoidProxy stands in the middle of the real login and collects the password, the multi-factor response, and the session cookie. Either result is a live work session. Ordinary prompts and one-time codes are already behind the victim by the time the operator has the cookie or the device-code token.

A Microsoft token of that kind reaches Microsoft 365 and the other apps that identity can open through single sign-on. A Google session is the mailbox and the files. Push Security has not pinned down the first hop that delivers the link. What it has seen are redirects through Google and Zapier shorteners, which borrow trust from names employees already click. Earlier waves of the same idea moved through GoTo Webinar’s mail and through real Zoom event pages. ANY.RUN described a July campaign that used Zoom pages to front fake Meta, OpenAI, and Anthropic events. Cofense has reported Anthropic-branded invites that left through GoTo Webinar and bounced across several sites before the fake registration page.

The pages also present a Cloudflare check before the event copy loads. That keeps a lot of automated scanners from ever seeing the lure. A clean scan of the short link is a weak comfort.

What to do before someone registers

Tell staff that a vendor does not charge a work login for a free Pro plan, a Grok subscription, or a slice of equity-shaped swag. An OpenAI, SpaceX, or Anthropic event that demands “Continue with Microsoft” or “Continue with Google” is the incident, even when the calendar date and the logo look right.

In Microsoft Entra, turn off device-code sign-in wherever the business does not run a device that needs it. Alert when the flow is used. The code on a conference site is the attacker’s code. Employees should approve a device code only for a television, a kiosk, or a command-line tool they started themselves.

Move administrators, and anyone who can reach mail and single sign-on apps, onto phishing-resistant factors such as FIDO2 security keys. Review sign-in logs from late October forward for device-code grants and for new sessions that follow an event-page visit. If someone already approved a code, revoke the session and the refresh tokens, and reset the path into Salesforce, Slack, and the other apps that identity opens.

Treat a Google or Zapier short link to an “event” as untrusted until the registration host is one your events team already uses. The shortened URL is how this wave borrows a trusted name.

This briefing relies on public reporting by BleepingComputer and on Push Security’s research. It does not include exploit procedures.