Fake AI Event Invitations Target Microsoft and Google Accounts in New Phishing Scam

Cybercriminals are using fake artificial intelligence (AI) event invitations to steal Microsoft and Google account credentials from employees. The fraudulent invitations impersonate popular technology companies, including OpenAI, SpaceX, and Anthropic, while promising free access to premium AI services and exclusive online events.

According to cybersecurity researchers at Push Security, the campaign uses convincing event registration websites and advanced phishing techniques to trick victims into approving malicious sign-in requests. Some attacks can bypass traditional multi-factor authentication (MFA), potentially giving criminals access to corporate emails, documents, and other connected business applications.

The campaign is particularly concerning because attackers are using legitimate authentication services and familiar website designs to make their scams appear trustworthy.

How Do Fake AI Event Invitations Trick Users?

The attackers are taking advantage of growing interest in AI tools and premium subscriptions.

Researchers discovered fraudulent websites advertising events that appeared to be organized by well-known technology companies.

Some examples included:

• Fake OpenAI event: An online presentation called "ChatGPT for Social & Digital Marketing Teams" promised participants three months of free ChatGPT Pro.

• Fake SpaceX briefing: An invitation-only event advertised three months of Grok Heavy or a supposed SpaceX share.

• Fake Anthropic event: A fraudulent page impersonated an Anthropic presentation associated with AWS re:Invent 2026.

These offers were designed to attract employees interested in new AI products and business opportunities.

However, participants were asked to register using their corporate Microsoft or Google accounts before receiving the advertised rewards.

This is where the phishing attack begins. Instead of providing free subscriptions or exclusive access, the fraudulent websites redirect users into malicious authentication processes designed to steal their account access.

How Hackers Steal Microsoft Accounts Without Knowing Passwords

One of the most concerning techniques identified in this campaign involves Microsoft's device authentication process.

When someone selects the "Continue with Microsoft" button on a fake event website, the page connects to a phishing service called Kali365.

The platform generates a Microsoft device authentication code and displays instructions telling the victim to copy that code and enter it on Microsoft's legitimate sign-in website.

The problem is that the authentication request was initiated by the attacker, not the user.

If the victim enters the supplied code, signs in, and approves the request, Microsoft can issue authentication tokens to the attacker's session.

These tokens may allow criminals to access Microsoft 365 resources without directly obtaining the victim's password.

The attack can then continue through another phishing service called VoidProxy, which attempts to capture additional login credentials and authenticated session cookies.

A successful compromise could expose company emails, business documents, and other connected workplace services.

How the Fake Google Login Page Steals Passwords and Session Cookies

The Google authentication option uses a different technique.

When victims select "Continue with Google," the fraudulent website opens a pop-up designed to resemble Google's familiar sign-in interface.

Behind the scenes, the attackers use VoidProxy, an adversary-in-the-middle (AiTM) phishing platform.

This technology acts as an intermediary between the victim and the legitimate authentication service.

As users enter their information, the malicious platform can capture:

• Google account usernames and passwords.

• Multi-factor authentication responses.

• Authentication session cookies.

• Information that may allow attackers to reuse an authenticated session.

Session cookies are particularly valuable to cybercriminals because they can help maintain an already authenticated login.

This means that simply enabling traditional MFA does not guarantee protection against every type of phishing attack.

What Are Kali365 and VoidProxy?

The investigation identified two phishing-as-a-service (PhaaS) platforms used in the campaign.

These services provide criminals with tools to conduct account theft without developing every component of an attack themselves.

Researchers also identified two custom phishing kits called ZoomMock and MSDRoot.

These kits were used to build fraudulent event registration pages that directed visitors toward the malicious authentication services.

Push Security found evidence suggesting the same operators were responsible for both event-page kits, although this connection was not conclusively established.

The researchers did not establish a direct relationship between the developers of Kali365 and VoidProxy.

Why These Fake AI Invitations Are Difficult to Detect

The campaign uses several techniques to make fraudulent websites appear legitimate.

1. Trusted link services: Attackers use shortened links associated with Google and Zapier to disguise the final website destination.

2. Cloudflare security checks: Fake websites display familiar human-verification challenges that can also make automated security scanning more difficult.

3. Professional event pages: The registration websites copy the appearance of legitimate technology company events.

4. Real Microsoft authentication: Victims may actually visit Microsoft's genuine device login page, but the authentication request was initiated by criminals.

5. Fake Google sign-in windows: VoidProxy creates convincing login experiences to capture credentials and authentication sessions.

6. Multiple languages: The fraudulent pages can automatically display content in different languages, helping attackers target users in different regions.

These techniques make the campaign particularly dangerous for employees who regularly attend online conferences, webinars, and technology presentations.

How to Protect Microsoft and Google Accounts From Fake AI Events

Users and businesses should take additional precautions when receiving invitations that promise free AI subscriptions or exclusive technology events.

Here are some practical security recommendations.

1. Verify AI Event Invitations

Before registering for an event, visit the company's official website independently.

Check its verified social media accounts and official event announcements rather than trusting links included in unexpected invitations.

2. Never Enter Unexpected Microsoft Device Codes

If an event registration page asks you to copy a device authentication code and enter it on Microsoft's website, stop and investigate.

A legitimate Microsoft sign-in page does not automatically mean the authentication request is safe.

Only approve device authentication requests that you personally initiated through a trusted process.

3. Avoid Unnecessary Corporate Account Sign-Ins

Be suspicious of websites that require your company Microsoft 365 or Google Workspace account to claim free subscriptions, event rewards, or promotional offers.

Verify the registration requirements with the organizer through independently obtained contact information.

4. Use Passkeys and Security Keys

Consider using phishing-resistant authentication methods, including FIDO2 security keys and supported passkeys.

These technologies provide stronger protection against fake login pages than traditional password-based authentication and many common MFA methods.

5. Check Website Addresses Carefully

Do not assume a website is safe simply because it displays familiar branding or uses HTTPS.

Avoid shortened links from unexpected messages and open official services directly through trusted bookmarks.

6. Keep Security Software Updated

Use updated antivirus software, browser protections, and endpoint security tools to help identify suspicious websites and malicious activity.

Organizations should also review Microsoft Entra security policies and restrict device-code authentication wherever it is not required for legitimate business operations.

What Should You Do If You Already Clicked a Fake AI Event Invitation?

If you have already interacted with a suspicious registration page, take action immediately.

• Close the suspicious website: If you only opened the page without entering information or approving authentication, close it and report the invitation.

• Contact your IT department: Immediately inform your company's security team if you entered corporate credentials or approved a device code.

• Change compromised passwords: Follow your organization's security team's instructions to reset affected passwords.

• Revoke active sessions: Ask administrators to investigate and revoke suspicious authentication sessions and tokens.

• Review account activity: Check for unusual sign-ins, suspicious email activity, and unexpected access to business applications.

• Report the phishing attempt: Share the invitation with your organization's security team so other employees can be warned.

Changing a password alone may not be sufficient because attackers could already possess valid authentication tokens or session cookies.

A security investigation should therefore include reviewing active sessions, authentication tokens, and connected applications.

Final Thoughts

Fake AI event invitations are becoming another effective weapon in cybercriminals' phishing campaigns. By impersonating OpenAI, SpaceX, and Anthropic, attackers are exploiting people's interest in AI subscriptions and exclusive technology events to steal Microsoft and Google account access.

The biggest concern is that these attacks do not always rely on traditional fake login pages. Device-code phishing and adversary-in-the-middle techniques can abuse legitimate authentication processes and bypass some conventional security protections.

Employees should verify unexpected event invitations, avoid approving unfamiliar authentication requests, and use phishing-resistant security methods wherever possible.

As AI-related scams become more sophisticated, checking an invitation before signing in could prevent serious account security problems.