Fake AI events used to steal Microsoft and Google credentials

The bait of fake AI events

Cybercriminals are launching a sophisticated phishing campaign that impersonates major technology companies like OpenAI, SpaceX, and Anthropic. According to a report from Push Security, these attackers create convincing registration pages for fake events to lure employees into clicking malicious links.

The lures are designed to appeal to corporate interests by offering high-value rewards. For example, one fake OpenAI event promises three months of ChatGPT Pro for participants, while another claims to offer a "SpaceX share" or access to Grok Heavy.

To reach their targets, the hackers use a variety of tactics to appear legitimate. They have been known to use trusted URL shorteners from services like Google and Zapier, and in some cases, they have abused legitimate email infrastructure from companies like GoTo Webinar and Zoom.

Bypassing security with PhaaS

The campaign is notable because it integrates two different phishing-as-a-service (PhaaS) platforms to target different types of corporate accounts. These platforms, known as Kali365 and VoidProxy, allow attackers to automate the process of stealing credentials and authentication sessions.

When a victim tries to sign in with a Microsoft account, the page uses Kali365 to initiate a device code phishing attack. This method abuses the legitimate OAuth 2.0 device authorization grant flow, which is a way for apps to get permission to access user data without requiring a password directly.

For Google accounts, the attackers use VoidProxy as an adversary-in-the-middle (AiTM) reverse proxy. This type of tool sits between the victim's browser and the real Google login page, allowing the attacker to intercept the login forms, the multi-factor authentication (MFA) responses, and the final session cookies.

How the theft occurs

The technical flow of these attacks is designed to be seamless for the victim. For Microsoft targets, the user is instructed to copy a code from the fake site and enter it into a legitimate Microsoft login page. Once the user approves the request, the attackers gain the authentication tokens needed to access resources like Microsoft 365, Slack, and Salesforce.

The attackers often use a second stage to ensure they get everything they need. After the initial Microsoft authentication is successful, the page may redirect the victim to a VoidProxy login page to capture the actual password and session cookie as well.

By capturing session cookies, the hackers can effectively bypass MFA. This is because the cookie represents an already authenticated session, allowing the attacker to enter the account without needing to provide a secondary code or biometric check during each new login.

Evasion and infrastructure

To stay ahead of security software, the attackers have built-in defenses on their fake websites. Before showing the registration page, the sites display a Cloudflare CAPTCHA to confirm the visitor is not a robot. This simple step helps prevent automated security platforms from scanning and flagging the phishing site.

Push Security identified two custom phishing kits used for these attacks, which they have tracked as ZoomMock and MSDRoot. Researchers believe the same group of threat actors is operating both kits because they share the same infrastructure and targeting methods.

The campaign has shown a pattern of evolving tactics. A similar operation in July involved abusing legitimate Zoom event pages to promote fake Meta and Anthropic events. This suggests the attackers are constantly looking for new ways to leverage trusted platforms to reach their victims.

Defending against session theft

Organizations can take several steps to protect their employees from these types of sophisticated phishing attacks. One primary recommendation is to restrict device code authentication to only the specific services where it is strictly necessary for business operations.

For more robust protection, security experts suggest moving toward phishing-resistant MFA. This includes using hardware-based solutions like FIDO2 security keys, which are much harder for an adversary-in-the-middle proxy to intercept than standard text or app-based codes.

Employees should be trained to be skeptical of any event invitations that require a corporate login to claim a reward. If a request asks for a device authentication code from an unfamiliar website, it is a major red flag that the user should not follow.

Next steps for security

The use of PhaaS platforms like Kali365 and VoidProxy makes it easier for low-skilled criminals to launch high-level attacks. As these tools become more accessible, the barrier to entry for stealing corporate credentials continues to drop, making it a growing concern for IT departments.

Security teams should monitor for unusual authentication patterns, particularly those involving device code grants from unexpected sources. They should also keep an eye on how attackers leverage trusted third-party services like Zapier and Google to mask their malicious links.

The ongoing trend of impersonating AI leaders like OpenAI and Anthropic suggests that these themes will remain popular. Attackers will likely continue to create high-quality fake registration pages that promise access to the latest AI tools to entice busy professionals.

Watch out for

Watch for new phishing kits that impersonate other major AI players or cloud providers.

Monitor for an increase in the use of trusted URL shorteners to hide malicious redirects.