Warning: Fake OpenAI and SpaceX Events Used to Steal Corporate Accounts
Attackers are leveraging fake event invitations to bypass MFA and hijack corporate sessions.
In the world of modern cybercrime, hackers are employing increasingly sophisticated tactics. Recent research reveals that attackers are conducting a large-scale phishing campaign using fraudulent event invitations in the names of OpenAI, SpaceX, and Anthropic. The goal is simple: to deceive corporate users and gain full control over their work accounts.
How the scheme works
Attackers create professionally designed websites that are nearly identical to legitimate registration platforms. Users are offered free access to premium services, such as three months of ChatGPT Pro or SpaceX "promotions." To increase credibility, the sites use Cloudflare CAPTCHA to evade automated security systems.
Once a victim reaches the registration page, they are prompted to authorise using their Microsoft or Google accounts. This is where the technical phase of the attack begins, as hackers utilise two specialised platforms: Kali365 and VoidProxy.
Hijacking Microsoft and Google accounts
If the user chooses Microsoft, Kali365 employs "device code" phishing. Victims are asked to enter a code on the official Microsoft website. By doing so, the user unwittingly grants hackers access to their account, bypassing multi-factor authentication (MFA). Once access is gained, hackers use VoidProxy to steal session cookies and passwords.
In the case of Google, VoidProxy acts as an "adversary-in-the-middle." It intercepts the user's entered credentials and authorisation codes in real-time. This method allows hackers to fully control the victim's session and gain access to corporate platforms such as Slack, Salesforce, SAP, and Dropbox.
How to protect yourself
Security experts urge employees to exercise extreme caution regarding invitations to unknown events. Key recommendations include:
- Never enter "device codes" on unfamiliar websites, even if they appear to be sent in the name of trusted brands.
- Use phishing-resistant multi-factor authentication, such as FIDO2 security keys, which eliminate the possibility of session hijacking.
- Pay close attention to links: hackers often use URL shortening services to hide the actual malicious address.
This campaign confirms once again that cybercriminals are actively exploiting the growing interest in artificial intelligence and the reputations of well-known companies. It is crucial for organisations to keep employees informed and implement strict security protocols to prevent such social engineering attempts in time.