---
title: Tip: treat AI-branded 'event RSVP' pages that demand Microsoft or Google work SSO as phishing until you verify the URL on the vendor's real site | ctxsec
url: https://ctxsec.com/items/tip-treat-ai-branded-event-rsvp-sso-as-phishing-until-verified
description: "The OpenAI/SpaceX/Anthropic fake-event campaign works because the reward (ChatGPT Pro, Grok Heavy, a 'share') feels plausible and the sign-in buttons look like normal SSO. A 30-second check stops it."
status: "confirmed research (Push Security, Nov 5)"
published: 2026-11-05
---

> The OpenAI/SpaceX/Anthropic fake-event campaign works because the reward (ChatGPT Pro, Grok Heavy, a 'share') feels plausible and the sign-in buttons look like normal SSO. A 30-second check stops it.

[← Tips & Guides](/tips) · [markdown](/items/tip-treat-ai-branded-event-rsvp-sso-as-phishing-until-verified.md)

confirmed research (Push Security, Nov 5)

2026-11-05

### Tip: treat AI-branded 'event RSVP' pages that demand Microsoft or Google work SSO as phishing until you verify the URL on the vendor's real site

- Open the vendor's real events or academy page yourself (type the domain; don't follow the invite). If the livestream or briefing isn't listed there, stop.
- Never complete a Microsoft **device code** prompt that appeared right after an email or short-link 'RSVP'. Real Microsoft device login is for apps you started, not for claiming event swag.
- Watch for Cloudflare bot checks and brand-new domains (`eventrsvp[.]app`, `*rsvp*`, lookalike webinar hosts) in front of AI-branded rewards.
- If someone already approved a device code or signed in: revoke sessions, reset the password, review OAuth app consents, and rotate any tokens minted in that window.

Sources: [Push Security: Analyzing a fake event campaign combining AiTM and device code phishing payloads (Nov 5)](https://pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis)