# Fake AI and SpaceX Events Used in Multi-Platform Phishing Campaign

> Threat actors use fake OpenAI, SpaceX, and Anthropic event invites with Kali365 and VoidProxy PhaaS to steal corporate Microsoft and Google accounts.

- Published: 2026-11-05T21:43:19.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Phishing, Credential Theft, MFA Bypass, Microsoft 365, Google Workspace
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
- Canonical: https://runtimerebel.com/blog/fake-ai-and-spacex-events-used-in-multi-platform-phishing-campaign

## Key points

- Corporate employees are targeted by phishing attacks using fake AI and aerospace event invitations to steal Microsoft and Google account credentials.
- Attackers leverage Kali365 for Microsoft device code phishing and VoidProxy as an adversary-in-the-middle reverse proxy for Google sign-in interception.
- Organizations must restrict unused device code authentication flows and deploy phishing-resistant FIDO2 security keys to prevent session hijacking.

## Overview of Fake Event [Phishing](/glossary#phishing) Campaigns

Threat actors have launched a sophisticated [credential harvesting](/glossary#credential-harvesting) campaign leveraging fraudulent event invitations for high-profile artificial intelligence and aerospace organizations, including OpenAI, SpaceX, and Anthropic. According to a report from [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/), the campaign uses convincing registration pages offering premium services—such as ChatGPT Pro, Grok Heavy, or speculative shares—to lure employees into authenticating with their corporate credentials.

## Technical Analysis of PhaaS Integration

What distinguishes this operation is the concurrent integration of two distinct [phishing-as-a-service](/glossary#phishing-as-a-service) (PhaaS) platforms: Kali365 and VoidProxy. These services are deployed via custom phishing kits tracked as ZoomMock and MSDRoot, which utilize shared infrastructure to target enterprise users.

### Targeting Microsoft via Kali365 and VoidProxy

When a victim selects the Microsoft authentication option, the phishing infrastructure interfaces with the Kali365 platform to initiate a device code phishing attack. This technique abuses the legitimate OAuth 2.0 device [authorization](/glossary#authorization) grant flow. Victims are prompted to copy a code and enter it on a genuine Microsoft login portal, inadvertently granting authentication tokens to the attackers without directly surrendering their passwords. Following successful token generation, the framework redirects the victim to a VoidProxy login page to additionally capture traditional passwords and session cookies.

### Targeting Google via Adversary-in-the-Middle

For Google accounts, the attack shifts to the VoidProxy platform configured as an adversary-in-the-middle reverse proxy. This component sits between the victim's browser and legitimate Google login endpoints, mirroring the interface to intercept credentials, multi-factor authentication ([MFA](/glossary#mfa)) responses, and active session cookies in real-time.

To evade automated security scrapers and [sandbox](/glossary#sandbox) analysis, the initial landing pages employ Cloudflare CAPTCHA challenges. Furthermore, distribution channels rely on trusted redirect mechanisms, including Google and Zapier URL shorteners, alongside compromised or abused webinar distribution systems.

## Mitigations and Defense Strategies

Defenders should implement specific countermeasures to disrupt device code abuse and [session hijacking](/glossary#session-hijacking) attempts:

* Restrict or disable OAuth 2.0 device code authentication policies across Microsoft Entra ID tenants where business requirements do not explicitly demand it.
* Deploy phishing-resistant authentication methods, such as FIDO2 security keys or passkeys, which render adversary-in-the-middle proxy interception ineffective.
* Educate employees regarding the risks of entering device authentication codes supplied by external websites, particularly those promising promotional software tiers or event access in exchange for corporate login credentials.

**Related:** [Q2 2026 IR Trends: Phishing, MFA Bypass, RMM Tool Abuse](/blog/q2-2026-ir-trends-phishing-mfa-bypass-rmm-tool-abuse), [Human-Operated Phishing Steals AI Ad Account Credentials](/blog/human-operated-phishing-steals-ai-ad-account-credentials)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/fake-ai-and-spacex-events-used-in-multi-platform-phishing-campaign