Fake OpenAI and SpaceX event pages used to steal Microsoft and Google logins
Phishing kits that capture session cookies can bypass a password, so the protection that matters is phishing-resistant MFA.
Attackers are luring employees with counterfeit registration pages for fake OpenAI, SpaceX and Anthropic events, promising perks such as free ChatGPT Pro, Grok Heavy access or a SpaceX share. Push Security reports that the pages chain two phishing-as-a-service platforms: Kali365 runs Microsoft device code phishing to obtain tokens, while VoidProxy works as an adversary-in-the-middle proxy that captures Google sign-ins and session cookies. Visitors are shown a CAPTCHA to evade scanners, then asked to sign in with a work account. Push Security says it detected and blocked visits to these pages in late October. Defenders are advised to restrict device code authentication where unneeded and adopt phishing-resistant MFA such as FIDO2 keys.
Why it matters
Employees who sign in to work accounts through a convincing event page can hand over access to Microsoft and Google services without ever entering a password on a fake login form, because the attacker relays the real sign-in and captures the resulting tokens and session cookies. Push Security reports the pages were active in late October, and the lures were chosen to appeal to people who follow AI and space companies. The defenses the report points to are narrower rules for device code sign-in and hardware-backed FIDO2 keys, which resist this kind of relay.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.