Hackers are using fake invitations to OpenAI, SpaceX and Anthropic events to trick employees into handing over their Microsoft and Google account credentials, according to research published on 5 November by Push Security. Each fake registration page combines two phishing-as-a-service platforms, Kali365 and VoidProxy, to attack both Microsoft and Google accounts at once. Both platforms are designed to defeat multi-factor authentication.

Free AI subscriptions as the bait

The fake pages advertise events that look legitimate and offer generous rewards for signing up. One impersonates an OpenAI Academy livestream titled "ChatGPT for Social & Digital Marketing Teams" and promises three months of ChatGPT Pro. Another promotes a private SpaceX event on 12 November, offering three months of Grok Heavy. A third page impersonated an Anthropic event at AWS re:Invent 2026 and has already been taken down.

Visitors are asked to sign in with a work account to claim the reward.

Two phishing engines in one page

Clicking "Continue with Microsoft" starts a device-code phishing attack through Kali365: the victim is shown a code to enter on what looks like a corporate authorisation screen, but it actually authorises an attacker-controlled device. Clicking "Continue with Google" opens a VoidProxy reverse proxy of Google's sign-in page, which intercepts the login and the session cookie in real time.

Push Security says it detected and blocked visits to the malicious pages in late October 2026. No victim count or number of compromised accounts has been published. OpenAI, SpaceX and Anthropic are being impersonated — there is no report that their own systems were breached. Employees should treat event invitations promising free premium subscriptions with suspicion and check the sender and the web address before signing in.

Sources: BleepingComputer, Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts, 5 November 2026; Push Security, AI-themed fake event campaign analysis, 5 November 2026.