Threat watch / Campaign
Fake OpenAI, SpaceX and Anthropic events phish work accounts
Fake event pages ask visitors to sign in with a work account. The Microsoft button runs device code phishing on Microsoft's real page; the Google button is a reverse proxy.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- Microsoft: the victim types a code on Microsoft's real device sign-in page, and Microsoft issues the tokens to the operator's Kali365 session. Google: a VoidProxy reverse proxy captures the password, the MFA response and the session cookie.[1] Checked 6 Nov 2026
- What was stolen
- Sign-in tokens and session cookies for Microsoft 365 and Google work accounts, and Google passwords.[1] Checked 6 Nov 2026
- Who was impacted
- Not public yet Checked 6 Nov 2026
- Threat actor
- Not attributed. Unknown. Push Security says the operator is most likely a customer of both the Kali365 and VoidProxy kits.
Timeline
- The first lure domains go live; they stay active until November 2. [1]
- Push Security publishes its analysis of the campaign, seen on its customers' browsers in late October. [1]
- IT-Connect reports the campaign and advises blocking device code sign-in for users who don't need it, as Microsoft recommends. [2][3]