MEDIUM Threat Intel #Phishing #Credential Theft #MFA Bypass

Fake AI and SpaceX Events Used in Multi-Platform Phishing Campaign

2026-11-05 21:43 UTC 2 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Corporate employees are targeted by phishing attacks using fake AI and aerospace event invitations to steal Microsoft and Google account credentials.
Attackers leverage Kali365 for Microsoft device code phishing and VoidProxy as an adversary-in-the-middle reverse proxy for Google sign-in interception.
Organizations must restrict unused device code authentication flows and deploy phishing-resistant FIDO2 security keys to prevent session hijacking.

Overview of Fake Event Phishing Campaigns

Threat actors have launched a sophisticated credential harvesting campaign leveraging fraudulent event invitations for high-profile artificial intelligence and aerospace organizations, including OpenAI, SpaceX, and Anthropic. According to a report from BleepingComputer, the campaign uses convincing registration pages offering premium services—such as ChatGPT Pro, Grok Heavy, or speculative shares—to lure employees into authenticating with their corporate credentials.

Technical Analysis of PhaaS Integration

What distinguishes this operation is the concurrent integration of two distinct phishing-as-a-service (PhaaS) platforms: Kali365 and VoidProxy. These services are deployed via custom phishing kits tracked as ZoomMock and MSDRoot, which utilize shared infrastructure to target enterprise users.

Targeting Microsoft via Kali365 and VoidProxy

When a victim selects the Microsoft authentication option, the phishing infrastructure interfaces with the Kali365 platform to initiate a device code phishing attack. This technique abuses the legitimate OAuth 2.0 device authorization grant flow. Victims are prompted to copy a code and enter it on a genuine Microsoft login portal, inadvertently granting authentication tokens to the attackers without directly surrendering their passwords. Following successful token generation, the framework redirects the victim to a VoidProxy login page to additionally capture traditional passwords and session cookies.

Targeting Google via Adversary-in-the-Middle

For Google accounts, the attack shifts to the VoidProxy platform configured as an adversary-in-the-middle reverse proxy. This component sits between the victim’s browser and legitimate Google login endpoints, mirroring the interface to intercept credentials, multi-factor authentication (MFA) responses, and active session cookies in real-time.

To evade automated security scrapers and sandbox analysis, the initial landing pages employ Cloudflare CAPTCHA challenges. Furthermore, distribution channels rely on trusted redirect mechanisms, including Google and Zapier URL shorteners, alongside compromised or abused webinar distribution systems.

Mitigations and Defense Strategies

Defenders should implement specific countermeasures to disrupt device code abuse and session hijacking attempts:

Restrict or disable OAuth 2.0 device code authentication policies across Microsoft Entra ID tenants where business requirements do not explicitly demand it.
Deploy phishing-resistant authentication methods, such as FIDO2 security keys or passkeys, which render adversary-in-the-middle proxy interception ineffective.
Educate employees regarding the risks of entering device authentication codes supplied by external websites, particularly those promising promotional software tiers or event access in exchange for corporate login credentials.

#Phishing #Credential Theft #MFA Bypass #Microsoft 365 #Google Workspace

X/Twitter LinkedIn Reddit HN

← Back to Articles