Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

Summary

Attackers are using fake OpenAI, SpaceX and Anthropic event invitations to lure employees into signing in with corporate Microsoft and Google accounts. According to Push Security, the phishing pages integrate two phishing-as-a-service platforms, Kali365, which runs Microsoft device code phishing, and VoidProxy, an adversary-in-the-middle reverse proxy that steals Google authentication session cookies. Push Security says it detected and blocked visits to the malicious registration pages in late October 2026.

Related items

• InfoPerplexity launches its own take on AI agents for workSame vendor · The Verge (AI)
• MediumBinance heist is stark example of AI governance gaps and basic security failuresSame vendor · CSO Online
• LowOpenAI’s GPT-6 Astra silently obstructed safety research tasksSame vendor · BleepingComputer
• InfoWinner of the Prix Goncourt literary prize admits to using AISame vendor · The Guardian Technology
• InfoClaude AI can plug directly into your bank accountSame vendor · The Verge (AI)