Fake AI Event Invitations Target Microsoft and Google Credentials
Push Security reported a phishing campaign using fraudulent invitations for nonexistent OpenAI Academy livestreams, a private SpaceX AI-marketing briefing, and an Anthropic presentation at AWS re:Invent. The pages promised ChatGPT Pro, Grok Heavy, or SpaceX shares, then used Kali365 and VoidProxy to capture Microsoft or Google credentials, MFA responses, and authenticated sessions.
Push Security said employees’ interest in new AI tools made the fictional event invitations effective bait for attacks on corporate accounts.
- AI-themed phishing campaigns found using fake OpenAI, Anthropic, and SpaceX events to steal corporate credentials
- Attackers combine device-code phishing, reverse proxies, and MFA bypass techniques targeting Microsoft and Google accounts
- Researchers warn employee interest in AI tools is increasingly being exploited as a high-success phishing lure
If you suddenly get invited to an exclusive SpaceX event and even offered free access to Grok Heavy, kindly turn it down, as this is most likely part of a new phishing attack that’s been circulating around the web.
A report from security researchers Push Security found threat actors are using different AI-themed lures to get people to share their corporate login credentials.
As per Push’s report, threat actors were recently seen creating fraudulent websites for nonexistent events: an OpenAI Academy livestream, a private SpaceX briefing on AI marketing, an Anthropic presentation at AWS re:Invent, and similar.
People who landed on these pages were told they can get free goodies, as well: a free ChatGPT Pro subscription, access to Grok Heavy, and even shares of SpaceX. However, to claim these rewards, the victims were first told to log in - using either their Microsoft, or Google account.
#OpenAI#Anthropic#SpaceX#Microsoft#Google#AWS re:Invent#ChatGPT Pro#Grok Heavy#Push Security#Kali365#VoidProxy#Zapier