Cybercriminals Steal Microsoft, Google Logins With Fake AI Event Invites Offering 3 Months Free
Updated
Updated · Fox News · Nov 15
Cybercriminals Steal Microsoft, Google Logins With Fake AI Event Invites Offering 3 Months Free
3 articles · Updated · Fox News · Nov 15
Summary
Push Security said attackers in late October blocked visits to fake OpenAI, SpaceX and Anthropic event pages that lured employees to sign in with corporate Microsoft or Google accounts.
Three months of ChatGPT Pro, Grok Heavy or even a "SpaceX share" were used as bait, while shortened Google and Zapier links plus Cloudflare checks made the invitations and registration pages look legitimate.
Microsoft users were pushed into entering attacker-generated device codes through Kali365, which can yield authentication tokens without a stolen password; Google users faced VoidProxy pop-ups built to capture credentials, MFA responses and session cookies.
Push Security did not say how many accounts were compromised, but warned the campaign can bypass protections many users trust, including some multifactor authentication flows.
Microsoft said Defender can block the reported threats, while researchers urged users to verify event invites independently, avoid unsolicited device-code prompts and consider phishing-resistant sign-ins such as FIDO2 keys or passkeys.
If attackers use genuine Microsoft login pages to steal access, how can you ever trust a standard sign-in prompt again?
When a simple verification check hides a session-stealing proxy, are traditional email defenses completely obsolete against AI-lure phishing campaigns?
Can your company survive a breach where changing passwords fails because hackers already hijacked your active browser session cookies?