Fake OpenAI, SpaceX and Anthropic Event Pages Hand Attackers Microsoft and Google Work Sessions Through Device Codes and Proxies. Push Security Published the Infrastructure, and It Is in Our Feed.
If someone on your marketing team gets an invitation to an OpenAI, SpaceX or Anthropic event, and the page asks them to paste a code into a Microsoft sign-in, tell them not to, and check your sign-in logs for device-code logins. Push Security published an analysis on November 5, 2026 of a phishing operation that uses those brands as bait to take Microsoft and Google work sessions. No OpenAI, SpaceX or Anthropic system is reported compromised. The brands are only the lure.
What Push saw
Push detected and blocked visits to the fake pages on customer browsers in late October 2026. It describes three lures. An OpenAI Academy livestream titled "ChatGPT for Social & Digital Marketing Teams" on November 4, promising three months of ChatGPT Pro. A SpaceX "Starship Product Briefing" on November 12, promising three months of Grok Heavy or a "SpaceX share." And "Anthropic at AWS re:Invent," which was no longer live when Push looked. The themes point at marketing staff. Push does not give detection counts or say who was compromised.
The invitation arrives through a Google short link or a Zapier link. Earlier waves used real Zoom event pages or mail sent through GoTo Webinar's sender. The victim then hits a Cloudflare managed challenge ("Confirm you're not a robot"), which stops most public scanners, and then an event page that wants a work account and offers "Continue with Microsoft" and "Continue with Google."
Two ways in
On the Microsoft path the page uses Kali365, a phishing-as-a-service platform. It requests a device code from Kali365 and shows it in a "Confirm access" box, then opens Microsoft's real device login page in a pop-up. The victim pastes the code, signs in and approves, and Microsoft issues tokens to the attacker's session. Push says the page then sends the victim on to a second sign-in proxy that captures the password and session cookie, so the operator gets a second chance.
On the Google path a pop-up titled "Portal" loads a VoidProxy reverse proxy. It relays Google's real sign-in and captures the password, the MFA response and the session cookie.
Push describes Kali365 and VoidProxy as separate platforms built to defeat MFA, and found no link between their developers. It judges the operator most likely a customer of both. We hold Kali365 already from a May FBI advisory, which described the kit's reverse-proxy token theft. This campaign shows it paired with device-code lures.
How Push ties it together
Push links two earlier kits, which it calls ZoomMock (fake Zoom event pages, May to October) and MSDRoot (newer event pages from October 22), with "medium-high" confidence. The kits share no code. The evidence is one shared domain, the same custom Cloudflare challenge page, the same targeting of marketing staff with AI-brand events, and similar proxy domain names. A code comment reading "Same as Claude" on an earlier page suggests lures are copied and not fully rebranded. Between October 20 and 30 the operator moved from Zoom to Anthropic to OpenAI, SpaceX and Claude themes. Push says the operator rotates domains every few weeks and probably runs more lures than it saw.
What to do
Tell staff, marketing first, that a web page should never ask them to paste a code into a Microsoft sign-in they did not start.
If you do not need device code sign-in, consider blocking it with a Conditional Access policy. This is Microsoft's own control and our suggestion. Push's article gives no tenant-level guidance.
Look in your sign-in logs for device-code authentications from devices or places you do not recognize, especially since October 20. If you find one, revoke the user's sessions and refresh tokens, and reset the password, because a stolen session cookie outlives a password change unless you revoke it.
Block the indicators below. Expect them to go stale, since the domains rotate every few weeks.
For Google accounts, the same logic applies: the proxy takes the session after MFA, so check for new sessions and devices.
Indicators
We added 22 registrable domains and one IP to the feed, all cited to Push Security and not our sighting. We listed registrable domains only. We did not add sslip.io, which hosts a collection hostname but is a shared public service, or the legitimate sites the flow abuses, such as Microsoft's device login, Google short links, Zapier and X.
Current infrastructure (Push saw it from October 7 to November 2): eventrsvp[.]app, rsvpconnect-events[.]com, shifts[.]icu, claudewebinnar[.]com, logins-offcevents[.]icu, ggkiejl[.]icu, ggleventapi[.]icu and wbdssologin[.]app. These went in at confidence 85.
Earlier infrastructure from the ZoomMock kit and older Kali365 backends (May to October), at confidence 80: us956web-zoom[.]us, us968web-zoom[.]us, ssomeetingportal[.]com, ssoeventportal[.]com, officegocrqb[.]com, offcevent-login[.]com, com-access-sharepoint[.]com, gle-access-eventregister[.]icu, workportalsso[.]com, careersggl[.]icu, gfmzrsj[.]icu, ggolshhk[.]icu, iceagelandforms[.]surf and emptytownmoon[.]de.
Collection server: 217.60.102[.]48, seen October 29 to 30, at confidence 85. It sits inside 217.60.102.0/24, which we already carry through Spamhaus DROP (SBL699566). That block was covered before this report, and the exact address is new. Block coverage is not the same as detecting this indicator, and Spamhaus gets the credit for the early listing, not us.
Hashes: none were published.
Limits
We read Push Security's analysis and the SecurityWeek roundup. We did not visit any of the domains or confirm which are still live. Push does not give detection counts, takedown status or victim numbers. We do not know who runs the operation. Confidence 80 to 85 reflects a single vendor's observation of rotating infrastructure.
Five percent of this is wrong somewhere. It always is. By the time you read this, some of these domains are probably gone and others have replaced them.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments