Hackers Use Fake Events to Steal Microsoft and Google Accounts

Threat actors are targeting corporate employees with fraudulent event invitations impersonating OpenAI, SpaceX, and Anthropic to compromise Microsoft and Google accounts. According to cybersecurity firm Push Security, the campaign combines two phishing-as-a-service platforms—Kali365 and VoidProxy—to execute OAuth 2.0 device code phishing and adversary-in-the-middle attacks that bypass multifactor authentication. Compromised credentials and session cookies grant illicit access to enterprise platforms, including Microsoft 365 and Google Workspace. Malaysian organisations and users experiencing suspicious activities or scams can report incidents directly to the National Scam Response Centre at 997 or Cyber999.

Key Facts

How Do the Phishing Attacks Compromise Corporate Accounts?

The campaign lures corporate users to fraudulent event registration websites promising incentives such as premium AI subscriptions. Victims selecting Microsoft authentication receive a Kali365 device code to enter on Microsoft's legitimate portal, granting attackers OAuth tokens. Choosing Google activates VoidProxy, a reverse proxy that intercepts credentials, session cookies, and multifactor authentication responses in real time.

Attackers distribute these links via trusted services, including Google and Zapier URL shorteners, after earlier iterations leveraged GoTo Webinar and Zoom systems. Visitors must first solve a Cloudflare CAPTCHA, which shields the phishing site from automated security analysis. Once authentication succeeds, attackers gain reach into linked SSO applications like Salesforce, Slack, SAP, and Dropbox.

The phishing infrastructure integrates two separate phishing-as-a-service platforms, Kali365 and VoidProxy, within the same landing pages to target multiple authentication flows.

Why Are Multifactor Authentication Defences Being Bypassed?

The attackers circumvent standard multifactor authentication mechanisms by intercepting authenticated tokens and session cookies rather than relying solely on passwords. The Kali365 platform abuses legitimate OAuth 2.0 device authorization grants without capturing passwords directly, whilst the VoidProxy adversary-in-the-middle proxy captures session cookies and active multifactor authentication responses as the user logs in.

In the Microsoft workflow, after the device code authentication succeeds, victims are redirected to a VoidProxy page to harvest passwords and session cookies as a secondary stage. By capturing active session tokens, threat actors can bypass traditional SMS or app-based authentication prompts and access connected corporate enterprise environments directly.

Device authorization grant abuse enables attackers to obtain valid corporate tokens directly from Microsoft's authentication servers without requiring the user to disclose their password.

What Should You Do?

• Exercise caution with event invitations: Avoid signing in with corporate accounts or accepting lures offering free software licenses, premium AI access, or company shares.
• Halt unfamiliar device code authorisations: Do not enter Microsoft device authentication codes into login portals when prompted by third-party or unverified websites.
• Restrict device code flows: System administrators should disable or restrict Microsoft Entra OAuth 2.0 device code authentication across organisational tenants where it is not strictly required.
• Deploy phishing-resistant MFA: Implement hardware-backed authentication, such as FIDO2 security keys, to mitigate adversary-in-the-middle session hijacking.

Common Questions

What lures are being used in this phishing campaign?

Attackers impersonate webinars and events from OpenAI, SpaceX, and Anthropic. Lures have included an OpenAI marketing session offering ChatGPT Pro subscriptions, a private SpaceX event advertising Grok Heavy or company shares, and a fraudulent Anthropic presentation themed around AWS re:Invent.

How do attackers evade automated security scanners?

The fraudulent event registration websites display a Cloudflare CAPTCHA prompt before presenting the login interfaces. This barrier requires visitors to confirm they are human, effectively blocking automated security crawlers and email protection scanners from inspecting or categorising the malicious payloads hosted on the landing pages.

What systems can attackers access following a compromise?

Obtaining corporate Microsoft Entra tokens enables threat actors to access connected single sign-on applications. This includes sensitive enterprise environments such as Microsoft 365, Google Workspace, Salesforce, Slack, SAP, Atlassian, Dropbox, Zendesk, and Adobe without triggering immediate re-authentication prompts.

Sources and Methodology

This dispatch is based exclusively on reporting from BleepingComputer, which details threat telemetry and research documented by Push Security in late October 2026. No external advisories, secondary documents, or vendor pages were independently inspected for this report.