Researchers at Push Security described a phishing campaign on November 5, 2026. The campaign uses fake event registration pages that borrow the names of OpenAI, SpaceX, and Anthropic. The pages promise prizes such as three months of ChatGPT Pro, three months of Grok Heavy, or a "SpaceX share." Every prize requires a sign-in with a work Microsoft or Google account. That sign-in is the trap.
The SpaceX page leans on the appeal of Elon Musk's companies. It advertises an invite-only Starship product briefing about Grok on November 12. The OpenAI page copies the look of the OpenAI Academy events site. Push says it detected and blocked visits to these pages in late October. The campaign borrows those brand names without any sign that the companies themselves were hacked. Push did not publish a victim count.
The links travel through trusted short-link services from Google and Zapier. A fake robot check then hides the page from many security scanners. Earlier versions of the same lure used real Zoom event pages and GoTo Webinar mail.
The Microsoft button is the clever part. It shows a short device code generated by a rented phishing service called Kali365. It then opens Microsoft's real device login page in a pop-up. A worker who pastes the code and approves the prompt hands account tokens to the attacker. Multifactor authentication does not stop this step. The worker completes the MFA prompt personally. The page then sends the worker to a fake Microsoft sign-in run by a second service, VoidProxy. That step collects the password and session cookie too.
The Google button opens a VoidProxy pop-up that relays Google's real sign-in page. That proxy captures the password, the MFA response, and the session cookie. The FBI warned about Kali365 in May. This campaign shows the same service now riding on superintelligence-themed bait.
The defenses are well known and effective. Treat any device code you did not request yourself as a red flag. A real device code comes from a TV, printer, or conference-room screen you are setting up. A web page offering free software is never that device. Be wary of any event that needs a work login before it hands out a reward.
Organizations on Microsoft 365 can use Microsoft Entra Conditional Access to block device code sign-in for everyone who does not need it. The FBI recommends auditing current device code use before turning that block on. Phishing-resistant MFA such as FIDO2 security keys handles the proxy half of the attack. Those methods are tied to the real website. This keeps a proxy from replaying them. The device code block handles the other half.
Gun Barrel City and East Texas businesses that want a quick review of device code settings and MFA strength can call My I.T. Consultants, a Microsoft-certified MSP, at 903-675-5431. The office is open Monday through Friday from 7:00 a.m. to 6:00 p.m.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
Image: My I.T. Consultants
