Identity
Fake OpenAI and SpaceX events chain two MFA bypasses
Fake AI event sign-ups chain Kali365 device code phishing with VoidProxy AiTM to take Microsoft and Google accounts. How the chain works and how to hunt it.
Push Security published an analysis on November 5 of fake registration pages for OpenAI, SpaceX and Anthropic events, aimed mostly at marketing staff. The OpenAI page advertised a November 4 livestream called "ChatGPT for Social & Digital Marketing Teams" offering three months of ChatGPT Pro. The SpaceX page offered an invite-only "Starship Product Briefing" on November 12, promising three months of Grok Heavy or a "SpaceX share". An "Anthropic at AWS re:Invent" page ran from October 22. Each page says a work account is required and offers "Continue with Microsoft" or "Continue with Google".
What sets this campaign apart is the chain behind those two buttons. The Microsoft button runs device code phishing from Kali365, the subscription kit the FBI warned about in May, and then hands the victim to a VoidProxy adversary-in-the-middle (AiTM) page that collects the password and session cookie as well. The Google button goes straight to VoidProxy. Any tenant that has blocked only one of those techniques is still exposed to the other.
How the chain works
Push could not see how invitations were first sent, but the links it found went through trusted redirectors: Google short links on c.gle and share.google, Zapier's zpr.io, and in one case an X logout redirect (x.com/logout?redirect_after_logout=) in front of the Google link. Earlier waves used GoTo Webinar's mail sender and genuine events.zoom.us pages. Each hop starts on a reputable domain, so URL reputation checks see little to block.
A Cloudflare managed challenge with a custom "Confirm you're not a robot" page then filters out automated scanners. The event page itself sits at <brand>.eventrsvp[.]app/event/<brand>/id<11 digits>/rsvp/, with /live/ and /join/ variants. It auto-translates, reuses one code base across brands, and reports each visitor step to a collection script at eventrsvp-217-60-102-48[.]sslip[.]io/collect.php.
On the Microsoft side, the page asks Kali365 for a device code and shows it in a "Confirm access" dialog. Device code flow is the OAuth sign-in meant for TVs and other devices without a keyboard: whoever holds the code receives the tokens once someone approves it. The "Open Microsoft" button opens the real login.microsoftonline.com/common/oauth2/deviceauth page in a pop-up, the victim signs in with their own MFA, and Microsoft issues access and refresh tokens to the operator's Kali365 session. The page then shows "Signed in as ..., opening Microsoft 365" and sends the victim to a VoidProxy Microsoft sign-in page on continue-to-office-.ggleventapi[.]icu, which captures the password and session cookie a second time.
Push does not say why the operator collects both. The result is a refresh token plus a password and live browser session, so one cleanup action rarely removes all of it.
The Google button opens a pop-up titled "Portal" on continue-to-event.claudewebinnar[.]com. It relays Google's real sign-in pages and keeps the password, the MFA response and the session cookie. VoidProxy's Microsoft proxies show real business news sites to scanners, so a sandbox verdict on the URL comes back clean.
Who is running it
Push tracks two in-house kits from this operator. ZoomMock built fake Zoom event pages from May 2026 and served them from register.rsvpconnect-events[.]com until October 20. MSDRoot, the kit behind the current pages, appeared on October 22. The kits share no code, so Push rates the link as medium-high confidence. The evidence is the shared rsvpconnect-events[.]com domain, the same custom Cloudflare challenge page seen on October 12 and October 29, and repeated "continue...event" and "offcevent" naming in proxy domains.
Kali365 and VoidProxy are rented. The FBI's IC3 alert I-052126-PSA of May 21, 2026 describes Kali365 as a Telegram-sold subscription service first seen in April 2026 that captures Microsoft 365 OAuth tokens. Okta first documented VoidProxy on September 11, 2025 as a phishing service that relays Microsoft and Google sign-ins and steals session cookies. Push found no link between the two developers and reads the operator as a customer of both.
Two earlier reports describe the same pattern. ANY.RUN described fake Meta, OpenAI and Anthropic "partner summit" pages on genuine Zoom event pages in July, and Cofense reported on October 29 that "Austin from nthropic" invitations were sent through GoTo Webinar and led to us968web-zoom[.]us, a domain Push ties to ZoomMock. A stolen Microsoft session also reaches apps federated to Entra ID, such as Salesforce, Slack, Atlassian and SAP.
What to do
Cover both stages in Microsoft Entra ID
Block device code flow with a Conditional Access authentication flows policy, as described in our EvilTokens post. The FBI alert also recommends blocking authentication transfer, the QR-code flow that moves a desktop sign-in to a phone, in the same policy. One detail helps during an incident: Microsoft applies "protocol tracking" to sessions that started with device code flow, so once the block is on, refresh tokens the operator already holds from that flow fail with AADSTS530036, and with a policy that targets all resources they stay unusable against any app.
That block does nothing against the VoidProxy page that follows. For that step, require an authentication strength of Phishing-resistant MFA (FIDO2 security keys, passkeys or Windows Hello for Business) in a Conditional Access policy, starting with marketing, communications and executive assistants. A passkey is bound to the real Microsoft domain, so a proxy cannot complete it, though it does not stop the device code step, which happens on the real page. Token Protection does not close this gap on its own: it covers native apps on Windows, macOS and iOS against Exchange Online, SharePoint Online and Teams, and browser support is a preview limited to Azure Resource Manager.
Enforce security keys in Google Workspace
In the Admin console, go to Security, Authentication, 2-step verification, select the organisational unit for exposed staff, and set Methods to "Only security key". Passkeys count as a security key here. Set the suspension grace period first so users without a key are not locked out. Okta reported in 2025 that users with phishing-resistant authenticators could not be phished through VoidProxy.
Hunt for the chain
In Log Analytics or Sentinel, look for a successful device code sign-in followed within 30 minutes by an interactive sign-in for the same user, which is the shape of this campaign's Microsoft branch:
let dc = SigninLogs
| where TimeGenerated > ago(30d)
| where AuthenticationProtocol == "deviceCode" and ResultType == 0
| project UserPrincipalName, DcTime = TimeGenerated, DcIP = IPAddress;
SigninLogs
| where TimeGenerated > ago(30d) and ResultType == 0 and IsInteractive == true
| join kind=inner dc on UserPrincipalName
| where TimeGenerated between (DcTime .. (DcTime + 30m))
| project UserPrincipalName, DcTime, DcIP, TimeGenerated, IPAddress, AppDisplayName, UserAgent
Compare the IP addresses on both rows with the user's normal locations. In the sign-in details, an Original transfer method of Device code flow marks a later token that traces back to a device code sign-in.
For Google, open Reporting, Audit and investigation, User log events, filter on login_success, and check Is suspicious, Challenge type and IP address for the weeks since October.
On the web side, search proxy and DNS logs for these hosts from Push's list. The operator rotates domains every few weeks, so they are most useful for looking back:
eventrsvp[.]app,rsvpconnect-events[.]comand their subdomains217.60.102[.]48andeventrsvp-217-60-102-48[.]sslip[.]ioclaudewebinnar[.]com,ggleventapi[.]icu,wbdssologin[.]app,logins-offcevents[.]icuus968web-zoom[.]usandofficegocrqb[.]comshifts[.]icurequests to/api/generate?lure=, the Kali365 backend
If an account was taken
Revoke the user's sessions in Entra ID and reset the password, because this chain also captured the password. In the Google Admin console, open Directory, Users, the user, Security, Sign-in cookies, and select Reset; then change the password. Then sign the user out of the federated SaaS apps one by one, because sessions in Salesforce or Slack live on after the identity provider revokes its own.
The wider lesson
Many tenants block device code flow and reserve phishing-resistant MFA for admins. This operator rents both techniques and runs them back to back against marketing staff, so both controls need to reach people outside IT.
We test both paths, device code and proxied sign-in, in our safeguarding and hardening work, and our security operations team builds sign-in hunts like the one above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the check.
Sources: Push Security, BleepingComputer, FBI IC3 PSA I-052126-PSA, Okta: VoidProxy, Microsoft Learn: authentication flows, Microsoft Learn: Token Protection, Google Workspace: deploy 2-Step Verification, Google Workspace: user log events, Google Workspace: user security settings.