NewsCompaniesFlawsGuides
Get the app

Fake OpenAI, SpaceX and Anthropic event invites steal Microsoft 365 and Google logins, even past two-factor

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Push Security says it blocked visits to fake registration pages for OpenAI, SpaceX and Anthropic events in late October. The lures promise perks such as three months of ChatGPT Pro, arrive through trusted link shorteners and sit behind a Cloudflare check that keeps security scanners out, then tell the visitor to sign in with a work account. On the Microsoft path a kit called Kali365 makes a device code and asks the victim to enter it on Microsoft's real login page, which hands the attacker access without a password. On the Google path a kit called VoidProxy relays the real sign-in and captures the password, the two-factor response and the session. Both get past ordinary two-factor codes.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

Timeline

  1. HARD publishes its alert, at High.

What to do

  1. Don't sign in to claim a prize or register for an event from an email or message.
  2. Open the company's own site by typing it.
  3. Never type a code that a website gives you into a Microsoft or Google login page.
  4. Assistants who manage an executive's calendar and invitations should be told.
  5. If someone did, sign out of all sessions, change the password, revoke the account's sessions in the security settings and call your IT contact.
  6. Security keys and passkeys resist the Google-style login-proxy attack, but they do not stop device-code phishing, because the victim signs in on Microsoft's real site and approves the attacker's session.
  7. IT teams should restrict device-code sign-in where it isn't needed, using Microsoft's Conditional Access authentication-flow controls.
  • Microsoft every Microsoft flaw being used in attacks
  • Google every Google flaw being used in attacks
  • Is ChatGPT safe? safe to use with care: what it collects, its record and the settings to change

References

  1. BleepingComputer (). “Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts”.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.