Fake OpenAI and SpaceX event pages are phishing Microsoft and Google work accounts

A page that looks like an invitation to an OpenAI or SpaceX event is asking people to sign in with a work account, and the sign-in is the point of the page. Push Security published the analysis on November 5, 2026: fake registration pages for OpenAI, SpaceX and Anthropic events, seen on customer browsers in late October. One button steals a Microsoft login by abusing a real Microsoft page. The other proxies Google’s login and takes the password, the multi-factor response and the session cookie.

What the pages offer

Push says the pages advertise an OpenAI Academy livestream, a private SpaceX briefing called “SpaceX AI for Marketing,” and Anthropic at AWS re:Invent. Each one tells the visitor to sign in with a work account to claim a reward: three months of ChatGPT Pro, three months of Grok Heavy, or a “SpaceX share.”

The OpenAI page copies the look of OpenAI’s own events site. The livestream it advertised, “ChatGPT for Social & Digital Marketing Teams,” was dated November 4. The SpaceX page offered an invite-only “Starship Product Briefing” on November 12. An Anthropic page was already down when Push looked. Both live pages Push examined ran on subdomains of eventrsvp.app, translated themselves into the visitor’s language, and required a work account. They are not OpenAI, SpaceX or Anthropic. Those companies are the brands being copied.

How the sign-in is stolen

Push splits the attack into the operator’s own pages and two rented phishing services, Kali365 and VoidProxy. Push’s names for the operator’s kits are ZoomMock, used for fake Zoom event pages from May to October 2026, and MSDRoot, the newer pages, first seen on October 22. Push rates the link between those two kits as medium-high: they do not share code, but Push saw both on the same domain, rsvpconnect-events.com, with the same bot-check page and the same kind of target, marketing staff invited to an AI event. Push does not think the Kali365 and VoidProxy authors are the same people. It thinks this operator is a customer of both.

The path Push describes:

1. The invitation arrives through a short link on a trusted service, such as a Google short link or Zapier’s zpr.io. Earlier waves used GoTo Webinar’s mail system or real Zoom event pages. In one link Push followed, an X logout redirect sat in front of the Google short link. The short link is there so a reputation check sees a known domain first.
2. A Cloudflare check asks the visitor to confirm they are not a robot. Push says most automated scans stop there, so the lure page itself is rarely classified.
3. The event page offers “Continue with Microsoft” and “Continue with Google.”
4. Microsoft starts a device-code login through Kali365. The page shows a code and a button that opens Microsoft’s real device login, login.microsoftonline.com. The person pastes the code on Microsoft’s own site and approves it. Microsoft then issues tokens to the attacker’s session. The lure then sends the person on to a second Microsoft sign-in, this time through VoidProxy, which captures the password and the session cookie as well.
5. Google opens a pop-up that is a VoidProxy reverse proxy of Google’s real sign-in. The password, the multi-factor prompt and the resulting session cookie are captured in the middle.

Device-code login is a legitimate Microsoft flow for devices that cannot show a normal browser login. Here it is used so the person authenticates on a real Microsoft page while the attacker receives the token. The Google path does not need that trick: the proxy sits in the middle of the normal login. Either way, a second factor on the account is not enough, because the attacker ends up with a session that has already passed it.

Push says the operator moved the theme from Zoom to Anthropic to OpenAI, SpaceX and Claude between October 20 and October 30, and that eventrsvp.app was three days old when investigated on November 2. Domains rotate every few weeks. Push also noticed sloppy leftovers: the OpenAI page still contained addresses that mention Claude, which it reads as each new lure being copied from an older one.

This sits next to earlier reporting Push cites. ANY.RUN, on July 15, described real Zoom event pages carrying partner-summit lures for Meta, OpenAI and Anthropic that branched into device-code and proxy phishing. Cofense, on October 29, described invitations “from Austin at nthropic,” with the A missing, sent through GoTo Webinar.

What you can do

1. Do not enter a device code that a website just showed you. Microsoft’s device login is real. The trick is that a stranger chose the code. If you did not start a login from a TV, a phone or a command line yourself, close the page.
2. An event that requires a work login in exchange for free AI access is the bait. A real registration does not need you to approve a Microsoft device code, and it does not need you to type a Google password into a pop-up that appeared from the invitation.
3. If you already approved a code or signed in on one of these pages, treat the account as compromised. From a device you trust, sign that account out of every session, change the password, and review mail rules, forwarding addresses and app grants. A new password alone leaves the stolen session alive. The same recovery order is in how infostealers steal sessions.
4. If you administer Microsoft 365, turn device-code login off where nobody uses it, and prefer a phishing-resistant factor such as a passkey or a security key. Our guide to locking down a Google or Apple account covers sessions and recovery on those two. The work account in this campaign is the one to check first.
5. A short link from Google or a newsletter tool is not proof the destination is safe. Open the event from the company’s own site if you actually meant to register.

How Frame helps

Frame does not see a device-code prompt inside a browser and does not block these pages. If you think a work or personal password was typed into a fake sign-in, change it from a clean device and sign out other sessions. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a lure that arrives at the wrong one is easier to set aside. Frame never collects or stores the leaked records themselves.

Related coverage

• How scammers use leaked data to make phishing personal: the same idea, a message that looks specific, applied here to a fake professional event.
• How infostealers steal your sessions, and why a new password isn’t enough: why signing out everywhere matters after a stolen login, even when no malware was installed.

Sources

• Push Security, Analyzing a fake event campaign combining AiTM and device code phishing payloads, November 5, 2026
• BleepingComputer, Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts, November 5, 2026