Fake OpenAI and SpaceX events steal Microsoft logins - 2

A phishing campaign is sending out invitations to fake events from OpenAI, SpaceX and Anthropic, and the goal is your work login. According to researchers at Push Security, who saw the pages in late October 2026, anyone who clicks "Continue with Microsoft" or "Continue with Google" on these pages can end up giving criminals a working session on their account, even if the account has two-step verification. [1] [2] If you use a work or school account, or run a small business on Microsoft 365 or Google Workspace, this one is aimed at you.

Push Security says its tools stopped customers from reaching bogus sign-up pages for events tied to three well-known brands. [2] One page an OpenAI livestream called "ChatGPT for Social & Digital Marketing Teams" on November 4, with three months of ChatGPT Pro as the prize. Another advertised an invite-only "Starship Product Briefing" from SpaceX on November 12, offering three months of Grok Heavy or a "SpaceX ." A third used the name Anthropic at AWS re:Invent, but it was already offline when the researchers looked. [2]

BleepingComputer, which reported the findings on November 5, notes that the pages tell visitors they must sign in with a work account to register and claim the reward. [1] That demand is the trap.

The target is employees, because the pages ask for corporate accounts. [1] A stolen Microsoft work account can open a lot more than email. Reporting on the campaign says tokens for an Entra account can reach Microsoft 365 and connected sign-in apps such as Salesforce, Google Workspace, Dropbox, Slack and Atlassian. [1] For a small business with no security team, one careless click by one person can expose the whole shared workspace.

The invitation arrives by email. The links pass through trusted services, including Google short links, Zapier's shortener and an x.com redirect, so the address you hover over does not look suspicious. [2] Before the fake page loads, a Cloudflare box asks you to confirm you are not a robot. Push says this keeps automated security scanners from seeing the page. [2]

On the Microsoft path, the page shows a short code and tells you to enter it on Microsoft's own device login page. That page is real, which is why it feels safe. This is called device code phishing: by typing the code and approving, you are authorizing the attacker's session, not your own. [1] [2] The page then sends you to a second fake sign-in that collects your password and session cookie. [2]

On the Google path, a pop-up shows a proxied copy of the real Google sign-in. Everything you type, including the two-step response, passes through the attacker's server, and the session cookie is captured as you log in. [1] [2]

Passwords, one-time codes and, most importantly, session tokens and cookies. With a valid session cookie, an attacker does not need your password or your code again; the service believes they are you. [1] Push says the operator uses two rented services: Kali365 for the device code step and VoidProxy as the middleman between you and the real login. [2]

The operator changes domains every few weeks, so a list of bad addresses goes stale fast. [2]

What the companies say

Push Security says its browser-based detection spots these pages as they load and that its customers need take no further action. [2] That is a vendor describing its own product. [2]

Cofense, which published a separate report on October 29, described a September wave using Anthropic as bait, sent from a genuine GoTo Webinar address. [3] Only that one company had described the wave, and the coverage reports no statement from OpenAI, SpaceX or Anthropic.

Treat any invitation that offers a prize in return for a work login as a scam. A real event does not need your company password to show you a schedule.

Never type a code from a website into Microsoft's device login page unless you started that sign-in yourself on your own device.

Open event pages by typing the company's address, not by clicking a link in an email, and check the full address bar before signing in.

If you already signed in, change your password from a different, clean device, sign out of all sessions, and review recent sign-ins for places or devices you do not know.

Tell whoever runs your IT. If you are the owner, revoke sessions for the account and check for new mail forwarding rules.

For owners and admins, the reports suggest turning off device code sign-in where nobody needs it and moving to phishing-resistant sign-in such as passkeys or hardware security keys, which resist this kind of session theft. [1] [3] If the same lure style looks familiar, our pages on the Microsoft Account Deactivation scam , the Google Customer Reward Program scam and the Account Validation Request email scam show how older versions of these tricks looked.

Expect the brand to change. Analyst Frank Dickson, quoted in coverage of the Cofense report, described the pattern as "three brands in three clicks" and said criminals simply pick the hottest name of the moment. [3] The SpaceX briefing date of November 12 is still ahead, so expect more clicks before that page disappears.

Frequently asked questions

OpenAI, SpaceX and Anthropic are used as bait in the pages Push Security found. Nothing in the reports says those companies were hacked.

Yes. Device code phishing and proxy pages capture the approval or the session cookie, so the attacker can act as you without a fresh code.

You are shown a code and told to enter it on Microsoft's real device login page. By approving it you give the attacker's session access to your account.

Change your password from a clean device, sign out of all sessions, check recent sign-ins and tell your IT . Cofense gives the same advice.

Nobody has published a number. Push Security only reports that it blocked visits, and Cofense gave no victim count.

Cofense (via Pasquale Pillitteri)

No yet. Be the first.