---
title: Hunt: fake OpenAI, SpaceX and Anthropic event RSVP pages chain Kali365 device-code phishing with VoidProxy AiTM to steal Microsoft and Google sessions | ctxsec
url: https://ctxsec.com/items/hunt-push-security-openai-spacex-anthropic-fake-event-kali365-voidproxy
description: "Push Security blocked visits to fake event registration pages that advertise an OpenAI Academy livestream (ChatGPT Pro reward), a private SpaceX 'Starship Product Briefing' (Grok Heavy or a 'SpaceX share'), and an Anthropic-at-re:Invent lure. Each page requires a work-account sign-in. 'Continue with Microsoft' starts a Kali365 device-code flow against the real Microsoft device-login page, then hands the victim to a VoidProxy Microsoft AiTM page for a second capture; 'Continue with Google' opens a VoidProxy reverse proxy of Google sign-in that takes password, MFA and session cookie. Push names the lure kits ZoomMock (May\u2013Oct) and MSDRoot (from Oct 22) and rates them medium-high as the same operators. Domains rotate every few weeks and sit behind Cloudflare managed challenges."
status: "confirmed research (Push Security, Nov 5); detections from late October 2026"
published: 2026-11-05
---

> Push Security blocked visits to fake event registration pages that advertise an OpenAI Academy livestream (ChatGPT Pro reward), a private SpaceX 'Starship Product Briefing' (Grok Heavy or a 'SpaceX share'), and an Anthropic-at-re:Invent lure. Each page requires a work-account sign-in. 'Continue with Microsoft' starts a Kali365 device-code flow against the real Microsoft device-login page, then hands the victim to a VoidProxy Microsoft AiTM page for a second capture; 'Continue with Google' opens a VoidProxy reverse proxy of Google sign-in that takes password, MFA and session cookie. Push names the lure kits ZoomMock (May–Oct) and MSDRoot (from Oct 22) and rates them medium-high as the same operators. Domains rotate every few weeks and sit behind Cloudflare managed challenges.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-push-security-openai-spacex-anthropic-fake-event-kali365-voidproxy.md)

confirmed research (Push Security, Nov 5); detections from late October 2026

2026-11-05

### Hunt: fake OpenAI, SpaceX and Anthropic event RSVP pages chain Kali365 device-code phishing with VoidProxy AiTM to steal Microsoft and Google sessions

- **Delivery tells:** invites via Google short links (c.gle / share.google), Zapier zpr.io, or an x.com logout redirect; Cloudflare 'Confirm you're not a robot' before the RSVP page; work account required to claim AI-tool rewards.
- **Lure hosts (Oct–Nov 2026 sample):** `eventrsvp[.]app` (openai. / spacex. subdomains), `rsvpconnect-events[.]com` (anthropic.), path pattern `/event/id<11 digits>/rsvp/` (also /live/, /join/); collection `eventrsvp-217-60-102-48.sslip[.]io/collect.php` (217.60.102[.]48).
- **PhaaS / proxy hosts used by this campaign:** Kali365 backend `62zr4vcasl.shifts[.]icu`; VoidProxy Google `claudewebinnar[.]com` (continue-to-event.); VoidProxy Microsoft `continue-to-office-.ggleventapi[.]icu`. These PhaaS hosts also serve other customers.
- **Defend:** warn or block unexpected Microsoft device-code approvals (especially after marketing 'event' links); treat AI-branded RSVP pages that demand corporate SSO as phishing until proven; prefer Conditional Access that restricts device-code flow (see our [device-code tip](/items/tip-block-device-code-flow)); hunt mail and proxy logs for the domains above and for pop-ups to login.microsoftonline.com/common/oauth2/deviceauth right after an RSVP click.

Sources: [Push Security: Analyzing a fake event campaign combining AiTM and device code phishing payloads (Nov 5)](https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis) · [BleepingComputer: Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts (Nov 5)](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/)