Skip to navigation

Threat reportPhishingTL-2026-5347

Fake OpenAI, SpaceX and Anthropic events used in device code and AiTM phishing to steal Microsoft and Google accounts

highACTIVE

A phishing campaign uses fake AI-themed events (OpenAI, SpaceX, and Anthropic at AWS re:Invent 2026) to lure corporate employees into surrendering Microsoft and Google account access. It combines OAuth 2.0 device code phishing against Microsoft Entra accounts (Kali365) with adversary-in-the-middle reverse proxying (VoidProxy) that captures credentials, MFA responses and session cookies.

Key facts for Kali365 AI event phishing

IdentifiersTL-2026-5347
Also known asZoomMock, MSDRoot
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Microsoft Entra ID / Microsoft 365 accounts; Google Google Accounts / Google Workspace
MalwareKali365, MSDRoot, VoidProxy, ZoomMock
MITRE ATT&CK techniquesT1078.004 Cloud Accounts, T1090 Proxy, T1111 Multi-Factor Authentication Interception, T1185 Browser Session Hijacking, T1204.001 Malicious Link, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1550.001 Application Access Token, T1557 Adversary-in-the-Middle, T1566.002 Spearphishing Link
MotivationFINANCIAL
Target sectorscorporate, technology, marketing, cybersecurity
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Kali365 AI event phishing

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5347 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Kali365 Device Code Phishing — Successful Entra ID Device Code Sign-In

TL-2026-5347: Detects successful Microsoft Entra ID sign-ins that used the OAuth 2.0 device authorization grant (authenticationProtocol=deviceCode). Kali365 and the fake OpenAI/SpaceX/Anthropic event lures steer victims to microsoft.com/devicelogin to enter an attacker-generated code; the victim completes genuine MFA and the attacker receives OAuth tokens without ever seeing the password. Any device code sign-in in a tenant that does not use the flow legitimately is a high-value account-takeover signal (T1528, T1078.004).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1528, T1078.004
  • Data sources: azure:monitor:aad (SignInLogs), Microsoft Entra ID SigninLogs, azure signinlogs
  • Severity: high
  • Confidence: high

Splunk SPL

index=azure sourcetype="azure:monitor:aad" category=SignInLogs properties.authenticationProtocol=deviceCode properties.status.errorCode=0 | eval user='properties.userPrincipalName', src_ip='properties.ipAddress', app='properties.appDisplayName', country='properties.location.countryOrRegion' | stats count AS signins min(_time) AS first_seen max(_time) AS last_seen values(app) AS apps values(country) AS countries by user, src_ip | convert ctime(first_seen) ctime(last_seen) | table user src_ip apps countries signins first_seen last_seen

Microsoft KQL

SigninLogs | where TimeGenerated > ago(24h) | where ResultType == '0' | where AuthenticationProtocol =~ 'deviceCode' or OriginalTransferMethod =~ 'deviceCodeFlow' | project TimeGenerated, UserPrincipalName, IPAddress, AutonomousSystemNumber, Location, AppDisplayName, ClientAppUsed, UserAgent, ConditionalAccessStatus, CorrelationId | order by TimeGenerated desc

Sigma

title: Entra ID Successful Device Code Flow Sign-In (Kali365 Device Code Phishing)
id: 5b0c3e1a-7d42-4f6e-9a18-3c2d9e7f4a51
status: experimental
description: Detects successful Microsoft Entra ID sign-ins using the OAuth 2.0 device authorization grant. Abused by Kali365 (S9044) and VoidProxy second-stage Microsoft attacks in fake AI-event phishing campaigns (TL-2026-5347).
references:
    - https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
    - https://attack.mitre.org/software/S9044/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
    - attack.initial-access
    - attack.t1078.004
    - attack.s9044
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationProtocol: deviceCode
        ResultType: 0
    condition: selection
falsepositives:
    - Legitimate sign-ins from input-constrained devices (Teams Rooms, IoT, Azure CLI or PowerShell on headless hosts)
    - Administrators using az login --use-device-code
level: medium

Known false positives:

  • Legitimate device code sign-ins from input-constrained devices such as Teams Rooms, kiosks or IoT
  • Administrators or developers using az login --use-device-code or PowerShell device authentication on headless hosts

Tuning notes: Allowlist known device-code users/service accounts and corporate egress IPs. Where the flow is not needed, pair with a Conditional Access policy blocking device code flow and treat any hit as high priority. Adjust the index/sourcetype to match your Splunk Add-on for Microsoft Cloud Services onboarding of Entra sign-in logs.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Fake AI Event Lure Emails (OpenAI, SpaceX, Anthropic AWS re:Invent) With Shortener or Webinar Links · unlock with TL Creds
  • AiTM Session Cookie Replay — Same Entra Session Used From Multiple IPs and ASNs · unlock with TL Creds
  • Entra ID Sign-Ins From VoidProxy Hosting ASNs ([indicator], [indicator], [indicator], [indicator], [indicator]) · unlock with TL Creds
  • User Navigation to Microsoft Device Login Page (Device Code Phishing Entry Point) · unlock with TL Creds
  • Post-Compromise Device or Security Info Registration After Device Code Phishing · unlock with TL Creds
  • VoidProxy AiTM Tracking Cookies [indicator] and [indicator] in Web Traffic · unlock with TL Creds
  • Kali365 Device Code Account Used From Multiple IPs and ASNs — Token Reuse · unlock with TL Creds
  • VoidProxy AiTM Infrastructure — Browser DNS Queries to [indicator], [indicator] and [indicator] · unlock with TL Creds

Indicators of compromise for Kali365 AI event phishing

As of 2026-11-05, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5347.

Sample indicators (3 of 22)

  • Domain: workers[.]dev
  • Domain: sslip[.]io
  • Domain: nip[.]io

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

22 indicators of compromise · unlock with TL Creds. Compare plans

How Kali365 AI event phishing works

BleepingComputer reported on 2026-11-05, citing Push Security research, a phishing campaign built around fake event invitations. Push Security detected and blocked malicious event-registration pages in late October 2026. The lures impersonate an OpenAI event ('ChatGPT for Social & Digital Marketing Teams') offering three months of ChatGPT Pro, a private SpaceX event on November 12 offering three months of Grok Heavy or a 'SpaceX share', and an Anthropic event at AWS re:Invent 2026 (later taken down).

Two custom phishing kits, tracked as ZoomMock and MSDRoot, generate the fake event pages. Links are distributed through Google and Zapier URL shorteners, GoTo Webinar email systems and legitimate Zoom event pages, and the phishing pages sit behind a Cloudflare CAPTCHA to keep automated scanners out. Victims who register are routed to credential-theft flows run by two phishing-as-a-service (PhaaS) platforms.

Kali365 performs Microsoft device code phishing. It abuses the OAuth 2.0 device authorization grant: the attacker generates a device code, the victim enters it on Microsoft's real device-login page and completes genuine MFA, and the attacker receives OAuth tokens without ever seeing the password. MITRE tracks Kali365 as S9044 (discovered April 2026, aliases Octopi365 and Freedom365, with ClickFix-style copy/paste execution lures). VoidProxy is an AiTM reverse proxy that sits between the victim's browser and Google's sign-in infrastructure, proxying the forms and capturing credentials, MFA responses and session cookies. It also serves as a second stage for Microsoft attacks.

Per Okta's 2025 analysis, VoidProxy uses Cloudflare Workers (*.workers.dev) as a CAPTCHA gatekeeper, low-reputation TLDs (.icu, .sbs, .cfd, .xyz, .top, .home), sslip.io and nip.io wildcard DNS for the proxy and C2 panels, and abuses legitimate email service provider accounts and URL shorteners for delivery. It sets the tracking cookies __xxdomstate (Google) and _xhooknstate (Microsoft 365). Earlier related activity includes a July 2026 campaign documented by ANY.RUN with fake Meta, OpenAI and Anthropic events, and Cofense-reported Anthropic-themed phishing delivered through GoTo Webinar. BleepingComputer also cites the EvilTokens PhaaS (12,000 Microsoft accounts compromised) and the BigBear service (MFA bypassed at 258 organizations) as related incidents.

No CVE is involved; the abuse is of legitimate authentication flows. The source article states no campaign-specific IPs, domains or hashes, so the IOC set below consists of sourced kit/platform names, infrastructure patterns, cookie names, ASNs and abused services rather than invented indicators. Severity HIGH is an analyst judgment based on MFA bypass and account-takeover impact.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078.004 Cloud Accounts; T1566.002 Spearphishing Link

Command and Control

T1090 Proxy

Credential Access

T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Collection

T1185 Browser Session Hijacking

Execution

T1204.001 Malicious Link

lateral-movement

T1550.001 Application Access Token

Lateral Movement

T1550.001 Application Access Token

Remediation for Kali365 AI event phishing

Immediate actions

  • Hunt Entra ID sign-in logs for device code flow authentications (authenticationProtocol = deviceCode) from unexpected users, locations or IPs and revoke the associated refresh tokens and sessions
  • Block or warn on workers.dev, sslip.io and nip.io destinations and newly registered domains on low-reputation TLDs in secure web gateway/DNS policy
  • Alert users to unsolicited AI-themed event invitations (OpenAI, SpaceX, Anthropic, AWS re:Invent) and to never enter a code supplied by a web page into microsoft.com/devicelogin

Workarounds

  • Block the OAuth device code flow with a Conditional Access policy for all users except those with a documented need
  • Restrict user consent and review OAuth application grants and recently registered devices

Longer-term hardening

  • Deploy phishing-resistant authentication (FIDO2/passkeys, device-bound credentials) for Microsoft and Google accounts
  • Enable token protection and continuous access evaluation, and monitor for anomalous session cookie/token reuse
  • Provide user awareness training covering device code phishing and AiTM

Affected and fixed versions

  • Microsoft — Microsoft Entra ID / Microsoft 365 accounts
    Vulnerable versions: Tenants permitting the OAuth 2.0 device authorization grant
  • Google — Google Accounts / Google Workspace
    Vulnerable versions: Accounts not protected by phishing-resistant authentication

Timeline of Kali365 AI event phishing

  • Okta Threat Intelligence publishes its analysis of the locked-ioc-9 AiTM PhaaS targeting Google and Microsoft accounts
  • locked-ioc-17 device code/AiTM phishing-as-a-service kit discovered in April 2026 (MITRE S9044; aliases Octopi365, Freedom365)
  • Cloud Security Alliance research note documents the surge in OAuth device code phishing
  • ANY.RUN documents an earlier campaign using fake Meta, locked-ioc-21 and locked-ioc-10 events (July 2026; exact day not stated in source)
  • Push Security detects and blocks malicious fake-event registration pages in late October 2026 (exact day not stated in source)
  • BleepingComputer publishes the report on fake locked-ioc-21, locked-ioc-22 and locked-ioc-10 events used to steal Microsoft and Google accounts
  • Date of the fictitious private locked-ioc-22 event used as a lure offering three months of Grok Heavy or a 'locked-ioc-22 share'

Sources cited for Kali365 AI event phishing

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats