Push Security has uncovered a new phishing campaign that uses fake invitations to seemingly exclusive AI events to trick employees into handing over their corporate Microsoft or Google login credentials. The scheme promises a free three‑month ChatGPT Pro subscription or other AI‑related rewards, then directs victims to register with their work accounts.
How the scam works
Attackers create convincing registration pages that impersonate well‑known technology companies such as OpenAI, SpaceX and Anthropic. The pages advertise events like a November 4 livestream titled “ChatGPT for Social & Digital Marketing Teams” and an invitation‑only SpaceX briefing on November 12. Visitors are asked to click “Continue with Microsoft” or “Continue with Google” to claim the promised benefits.
Choosing the Microsoft option launches a phishing‑as‑a‑service platform called Kali365. This service generates a legitimate‑looking Microsoft device authentication code, which the victim is instructed to copy and paste into Microsoft’s official sign‑in page. Because the attacker initiates the authentication request, the resulting token can give the attacker access to Microsoft 365 resources without needing the user’s password.
For the Google option, the phishing page opens a pop‑up that mimics Google’s sign‑in screen but actually routes the credentials through a service named VoidProxy. This tool captures the user’s password, intercepts certain multi‑factor authentication responses, and steals session cookies that allow continued access to the account.
Why it’s dangerous
Both methods can bypass standard multi‑factor authentication safeguards. A stolen session cookie or authentication token can let attackers read corporate email, access documents, and move laterally within an organization’s network. The campaign also uses shortened links from Google and Zapier, as well as legitimate‑looking Zoom and GoTo Webinar infrastructure, to make the malicious URLs appear trustworthy.
Push Security blocked visits to the malicious pages in late October 2026 and identified two phishing kits—ZoomMock and MSDRoot—used to build the fake event sites. The researchers noted that the pages can automatically display content in the visitor’s language, allowing the campaign to target users worldwide.
Protecting yourself
Employees should be skeptical of unsolicited invitations promising free AI tools, especially when they require corporate login credentials. Verify event legitimacy through official company channels before clicking any links. Organizations are encouraged to educate staff about these tactics and to enforce strict verification processes for any request to sign in using corporate accounts.
While Push Security’s report did not disclose how many accounts were actually compromised, the sophistication of the scheme underscores the need for continued vigilance against phishing attacks that exploit the growing interest in artificial intelligence.
Original reporting: Fox News (HLL/CB) — read the source article.
