Fake OpenAI, SpaceX and Anthropic event invites used to steal Microsoft and Google accounts

Phishing pages dressed up as OpenAI, SpaceX and Anthropic events are being used to take over Microsoft and Google accounts, according to a Push Security report covered by BleepingComputer on November 5, 2026.

The pages look like event registration sites and dangle rewards: three months of ChatGPT Pro, three months of Grok Heavy or a "SpaceX share", a private SpaceX event on November 12. To claim any of it, visitors are told to sign in with their work account. Push Security says it detected and blocked visits to the pages in late October 2026.

Two phishing kits, tracked as ZoomMock and MSDRoot, build the fake pages. Behind them sit two phishing-as-a-service platforms. Kali365 runs Microsoft device code phishing: the page generates a device authentication code, the visitor enters it on Microsoft's real device login page and approves it, and the platform walks off with authentication tokens. VoidProxy is an adversary-in-the-middle reverse proxy that captures Google credentials, MFA responses and session cookies, and serves as a second stage on the Microsoft path to collect the password and cookie too.

A Cloudflare CAPTCHA sits in front of the pages, which the report says keeps automated scanners off them. How the links are first distributed is unclear; Push Security found redirects through Google and Zapier URL shorteners, and earlier versions went out through GoTo Webinar email and legitimate Zoom event pages.

The practical check for defenders is device code flow. If nobody in your tenant needs it, restrict it, and treat any unsolicited event invite that asks for a work sign-in as a credential request. Phishing-resistant MFA such as FIDO2 keys is the other lever the report names. Neither stops a user pasting a code into Microsoft's own page, which is why the device code setting matters more here.