Skip to content
Phishing Campaign Exploits AI Event Lures to Steal Credentials

Phishing Campaign Exploits AI Event Lures to Steal Credentials

First seen 6 Nov 2026, 18:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 18:16 UTC
  • •Phishing campaign targets corporate accounts via fake AI event invitations.
  • •Attackers use device-code phishing and reverse proxies to steal credentials.
  • •Victims are promised rewards to lure them into providing login information.

A phishing campaign is targeting corporate credentials through fake event invitations from OpenAI, SpaceX, and Anthropic. Researchers at Push Security reported that attackers are using device-code phishing and reverse proxies to capture Microsoft and Google account credentials. Victims are lured with promises of free access to AI tools, such as ChatGPT Pro and Grok Heavy, but must log in with their corporate accounts to claim rewards. The attack method bypasses multi-factor authentication by capturing session tokens and cookies. The phishing links are distributed via email and utilize trusted URL shorteners to appear legitimate. Push Security has identified the use of two phishing-as-a-service platforms, Kali365 and VoidProxy, in this campaign. The campaign is ongoing, and employees are urged to be cautious of unexpected event invitations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7d ago How this analysis works

Timeline

2026-10-31
Phishing pages identified
Push Security discovered fraudulent event pages impersonating OpenAI, SpaceX, and Anthropic aimed at stealing credentials.
2-Spyware
2026-11-05
Findings reported
BleepingComputer reported on the phishing campaign, detailing the methods used to capture credentials.
Techradar
2026-11-06
Public awareness raised
Both 2-Spyware and Techradar published articles to inform the public about the ongoing phishing campaign.
2-Spyware

More articles in this cluster (2)

Following this threat?

Track VoidProxy and Anthropic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4

Common questions

Who is affected by this phishing campaign?
Employees using Microsoft and Google accounts, particularly those in corporate environments, are the primary targets.
What should I do if I receive a suspicious event invitation?
Do not click on any links or provide your login credentials; verify the invitation through official channels.
How can I protect my accounts from this type of phishing?
Enable multi-factor authentication and be cautious of unsolicited invitations, especially those promising rewards.