# Fake OpenAI, SpaceX and Anthropic events used in device code and AiTM phishing to steal Microsoft and Google accounts

> A phishing campaign uses fake AI-themed events (OpenAI, SpaceX, and Anthropic at AWS re:Invent 2026) to lure corporate employees into surrendering Microsoft and Google account access. It combines OAuth 2.0 device code phishing against Microsoft Entra accounts (Kali365) with adversary-in-the-middle reverse proxying (VoidProxy) that captures credentials, MFA responses and session cookies.

- **Published:** 2026-11-05T21:44:08Z
- **Last reviewed:** 2026-11-05T21:44:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5347
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5347.png
- **ID:** TL-2026-5347
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

BleepingComputer reported on 2026-11-05, citing Push Security research, a phishing campaign built around fake event invitations. Push Security detected and blocked malicious event-registration pages in late October 2026. The lures impersonate an OpenAI event ('ChatGPT for Social & Digital Marketing Teams') offering three months of ChatGPT Pro, a private SpaceX event on November 12 offering three months of Grok Heavy or a 'SpaceX share', and an Anthropic event at AWS re:Invent 2026 (later taken down).

Two custom phishing kits, tracked as ZoomMock and MSDRoot, generate the fake event pages. Links are distributed through Google and Zapier URL shorteners, GoTo Webinar email systems and legitimate Zoom event pages, and the phishing pages sit behind a Cloudflare CAPTCHA to keep automated scanners out. Victims who register are routed to credential-theft flows run by two phishing-as-a-service (PhaaS) platforms.

Kali365 performs Microsoft device code phishing. It abuses the OAuth 2.0 device authorization grant: the attacker generates a device code, the victim enters it on Microsoft's real device-login page and completes genuine MFA, and the attacker receives OAuth tokens without ever seeing the password. MITRE tracks Kali365 as S9044 (discovered April 2026, aliases Octopi365 and Freedom365, with ClickFix-style copy/paste execution lures). VoidProxy is an AiTM reverse proxy that sits between the victim's browser and Google's sign-in infrastructure, proxying the forms and capturing credentials, MFA responses and session cookies. It also serves as a second stage for Microsoft attacks.

Per Okta's 2025 analysis, VoidProxy uses Cloudflare Workers (*.workers.dev) as a CAPTCHA gatekeeper, low-reputation TLDs (.icu, .sbs, .cfd, .xyz, .top, .home), sslip.io and nip.io wildcard DNS for the proxy and C2 panels, and abuses legitimate email service provider accounts and URL shorteners for delivery. It sets the tracking cookies __xxdomstate (Google) and _xhooknstate (Microsoft 365). Earlier related activity includes a July 2026 campaign documented by ANY.RUN with fake Meta, OpenAI and Anthropic events, and Cofense-reported Anthropic-themed phishing delivered through GoTo Webinar. BleepingComputer also cites the EvilTokens PhaaS (12,000 Microsoft accounts compromised) and the BigBear service (MFA bypassed at 258 organizations) as related incidents.

No CVE is involved; the abuse is of legitimate authentication flows. The source article states no campaign-specific IPs, domains or hashes, so the IOC set below consists of sourced kit/platform names, infrastructure patterns, cookie names, ASNs and abused services rather than invented indicators. Severity HIGH is an analyst judgment based on MFA bypass and account-takeover impact.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1550.001 Application Access Token
- T1550.001 Application Access Token
- T1090 Proxy
- T1185 Browser Session Hijacking
- T1078.004 Cloud Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Kali365 Device Code Phishing — Successful Entra ID Device Code Sign-In** (`TL-2026-5347-SPL-001`)

TL-2026-5347: Detects successful Microsoft Entra ID sign-ins that used the OAuth 2.0 device authorization grant (authenticationProtocol=deviceCode). Kali365 and the fake OpenAI/SpaceX/Anthropic event lures steer victims to microsoft.com/devicelogin to enter an attacker-generated code; the victim completes genuine MFA and the attacker receives OAuth tokens without ever seeing the password. Any device code sign-in in a tenant that does not use the flow legitimately is a high-value account-takeover signal (T1528, T1078.004).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1078.004
- **Data sources:** azure:monitor:aad (SignInLogs), Microsoft Entra ID SigninLogs, azure signinlogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" category=SignInLogs properties.authenticationProtocol=deviceCode properties.status.errorCode=0 | eval user='properties.userPrincipalName', src_ip='properties.ipAddress', app='properties.appDisplayName', country='properties.location.countryOrRegion' | stats count AS signins min(_time) AS first_seen max(_time) AS last_seen values(app) AS apps values(country) AS countries by user, src_ip | convert ctime(first_seen) ctime(last_seen) | table user src_ip apps countries signins first_seen last_seen
```

### Microsoft KQL

```kql
SigninLogs | where TimeGenerated > ago(24h) | where ResultType == '0' | where AuthenticationProtocol =~ 'deviceCode' or OriginalTransferMethod =~ 'deviceCodeFlow' | project TimeGenerated, UserPrincipalName, IPAddress, AutonomousSystemNumber, Location, AppDisplayName, ClientAppUsed, UserAgent, ConditionalAccessStatus, CorrelationId | order by TimeGenerated desc
```

### Sigma

```yaml
title: Entra ID Successful Device Code Flow Sign-In (Kali365 Device Code Phishing)
id: 5b0c3e1a-7d42-4f6e-9a18-3c2d9e7f4a51
status: experimental
description: Detects successful Microsoft Entra ID sign-ins using the OAuth 2.0 device authorization grant. Abused by Kali365 (S9044) and VoidProxy second-stage Microsoft attacks in fake AI-event phishing campaigns (TL-2026-5347).
references:
    - https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
    - https://attack.mitre.org/software/S9044/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.credential-access
    - attack.t1528
    - attack.initial-access
    - attack.t1078.004
    - attack.s9044
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationProtocol: deviceCode
        ResultType: 0
    condition: selection
falsepositives:
    - Legitimate sign-ins from input-constrained devices (Teams Rooms, IoT, Azure CLI or PowerShell on headless hosts)
    - Administrators using az login --use-device-code
level: medium
```

**Known false positives:**

- Legitimate device code sign-ins from input-constrained devices such as Teams Rooms, kiosks or IoT
- Administrators or developers using az login --use-device-code or PowerShell device authentication on headless hosts

**Tuning notes:** Allowlist known device-code users/service accounts and corporate egress IPs. Where the flow is not needed, pair with a Conditional Access policy blocking device code flow and treat any hit as high priority. Adjust the index/sourcetype to match your Splunk Add-on for Microsoft Cloud Services onboarding of Entra sign-in logs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake AI Event Lure Emails (OpenAI, SpaceX, Anthropic AWS re:Invent) With Shortener or Webinar Links (locked: unlock with TL Creds)
- AiTM Session Cookie Replay — Same Entra Session Used From Multiple IPs and ASNs (locked: unlock with TL Creds)
- Entra ID Sign-Ins From VoidProxy Hosting ASNs ([indicator], [indicator], [indicator], [indicator], [indicator]) (locked: unlock with TL Creds)
- User Navigation to Microsoft Device Login Page (Device Code Phishing Entry Point) (locked: unlock with TL Creds)
- Post-Compromise Device or Security Info Registration After Device Code Phishing (locked: unlock with TL Creds)
- VoidProxy AiTM Tracking Cookies [indicator] and [indicator] in Web Traffic (locked: unlock with TL Creds)
- Kali365 Device Code Account Used From Multiple IPs and ASNs — Token Reuse (locked: unlock with TL Creds)
- VoidProxy AiTM Infrastructure — Browser DNS Queries to [indicator], [indicator] and [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- Domain: `workers[.]dev`
- Domain: `sslip[.]io`
- Domain: `nip[.]io`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/)
- [Kali365 - MITRE ATT&CK Software S9044](https://attack.mitre.org/software/S9044/)
- [Uncloaking VoidProxy: a Phishing-as-a-Service platform targeting Microsoft 365 and Google accounts (Okta Threat Intelligence)](https://www.okta.com/fr-fr/blog/threat-intelligence/uncloaking-void-proxy/)
- [Hijacker helper VoidProxy boosts Google, Microsoft accounts on demand (The Register)](https://www.theregister.com/2025/09/11/voidproxy_phishing_service/)
- [FBI-Flagged Phishing Kit Kali365 Expands Its Reach (Dark Reading)](https://www.darkreading.com/cyber-risk/fbi-flagged-phishing-kit-kali365-expands-its-reach)
- [Kali365: anatomy of a Microsoft 365 phishing-as-a-service kit (SpyCloud)](https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/)
- [CSA research note: OAuth device code phishing surge](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/CSA_research_note_oauth-device-code-phishing-surge_20260405-csa-styled.pdf)
- [Cybersecurity firms targeted by fraudulent OpenAI organization invites (BleepingComputer)](https://bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5347