Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake event invitations for OpenAI and SpaceX to trick employees into phishing attacks, stealing Microsoft and Google account credentials.
Intelligence analysis by Gemini 2.5 Flash Lite
Cybercriminals are leveraging convincing fake event registration pages for prominent tech companies like OpenAI and SpaceX to lure employees into phishing schemes. These pages, often distributed via trusted URL shorteners or webinar platforms, employ sophisticated phishing-as-a-service tools to steal both credentials and authentication sessions for Microsoft and Google accounts.
Imagine hackers pretend to host cool parties for famous companies like OpenAI and SpaceX. They send fake invitations promising free access to AI tools or special gifts. If you click the link and sign in with your work account, the hackers steal your login details, like a secret key to your company's computer, and can get inside.
Analysis
OpenAI
Attackers are impersonating events hosted by OpenAI, a leading artificial intelligence research laboratory, to create a facade of legitimacy for their phishing operations. One such fake event, advertised as "ChatGPT for Social & Digital Marketing Teams," promised participants three months of ChatGPT Pro. This tactic leverages the widespread interest in advanced AI tools like ChatGPT to entice potential victims. By offering premium access or exclusive benefits, the threat actors aim to lower the guard of employees, making them more susceptible to clicking malicious links and entering their corporate credentials. The use of OpenAI's brand, known for cutting-edge AI development, adds a layer of credibility to the fraudulent invitations, making them appear as genuine opportunities for professional development or access to exclusive services.
SpaceX
Similarly, threat actors are also impersonating events associated with SpaceX, the aerospace manufacturer and space transport services company founded by Elon Musk. A notable example includes a fake private SpaceX event scheduled for November 12, which purported to offer registrants either three months of Grok Heavy (a reference to SpaceX's AI chatbot) or a "SpaceX share." This strategy capitalizes on the public's fascination with space exploration and the innovative technologies developed by SpaceX. By associating their phishing campaigns with high-profile, forward-thinking companies like SpaceX, the attackers create a sense of urgency and exclusivity. The promise of unique rewards, such as company shares or advanced AI access, serves as a powerful lure, encouraging employees to engage with the fraudulent registration pages and ultimately compromise their accounts.
VoidProxy
A critical component of these sophisticated attacks is the use of the VoidProxy phishing-as-a-service (PhaaS) platform. VoidProxy functions as an adversary-in-the-middle (AiTM) reverse proxy, effectively positioning itself between the victim's browser and the legitimate login page of services like Google. This allows the attackers to intercept and steal not only usernames and passwords but also multi-factor authentication (MFA) responses and crucial session cookies. In the case of Microsoft account compromises, VoidProxy is employed as a second stage, capturing credentials and session cookies after an initial authentication token has been obtained through another service, Kali365. This dual-platform approach, combining Kali365 for Microsoft device code phishing and VoidProxy for both Microsoft and Google accounts, demonstrates a highly coordinated and technically advanced phishing operation designed to maximize credential and session theft.
Key points
- Hackers are using fake event invitations for OpenAI and SpaceX to conduct phishing attacks.
- The attacks aim to steal Microsoft and Google account credentials and authentication sessions.
- Two phishing-as-a-service platforms, Kali365 and VoidProxy, are employed in these campaigns.
- Microsoft accounts are targeted using device code phishing, while Google accounts are targeted via AiTM reverse proxy attacks.
- Victims are lured by promises of free AI services or exclusive rewards.
The detection and blocking of these malicious event registration pages by security researchers like Push Security demonstrate the effectiveness of proactive threat intelligence. Continued vigilance and rapid response from security firms can help mitigate the impact of such campaigns by identifying and neutralizing phishing infrastructure before widespread compromise occurs.
The sophisticated use of multiple phishing-as-a-service platforms, combined with convincing lures like fake AI and SpaceX events, indicates a growing threat to corporate accounts. The ability to bypass MFA through device code authentication and session hijacking poses a significant risk, potentially leading to extensive data breaches and unauthorized access to sensitive corporate resources.
