no, you did not win three months of Grok Heavy and a SpaceX share. you won an MFA-bypassing phish.

an operator is mailing marketing teams invitations to AI events that do not exist: an OpenAI Academy livestream, a private SpaceX briefing on “SpaceX AI for Marketing,” Anthropic at AWS re:Invent. the swag is three months of ChatGPT Pro, three months of Grok Heavy, or a “SpaceX share.” the catch is you sign in with your work account first. Push Security says the Microsoft button hands your tokens to one phishing-as-a-service kit and the Google button hands your session to another. MFA is not invited.

the lure

per Push, the operator built fake registration pages for three brands:

• OpenAI: copies the look of the OpenAI Academy events site. advertises a November 4 livestream called “ChatGPT for Social & Digital Marketing Teams.” prize: 3 months of ChatGPT Pro.
• SpaceX: an invite-only “Starship Product Briefing” on SpaceX AI for marketing and Grok, dated November 12. you pick 3 months of Grok Heavy or a “SpaceX share.”
• Anthropic: “Anthropic at AWS re:Invent.” this variant was no longer live when Push investigated.

every page says a work account is required and offers “Continue with Microsoft” and “Continue with Google.” the pages translate themselves into the visitor’s language, because nothing says “exclusive briefing” like machine-translated urgency.

the target is marketing staff. which tracks. marketing teams are the people most likely to be told by leadership to “get on the AI thing,” most likely to have access to brand social accounts and ad spend, and least likely to have been invited to the security team’s device code awareness training, assuming that training exists, which it does not.

the delivery chain, hop by hop

Push describes the invitation link routing through trusted services before it ever reaches the operator’s domain:

• a Google short link (c.gle or share.google) or Zapier’s zpr.io.
• in the link Push followed, an x.com logout redirect came before the c.gle link.
• earlier invitations came from GoTo Webinar’s mail sender or from real events.zoom.us event pages.
• a Cloudflare managed challenge in front of the lure domain, with a custom page saying “Confirm you’re not a robot.” Push notes most public scans of the lure domains stop right there.

so the URL reputation check sees Google, Zapier, X, and Cloudflare. four of the most trusted names on the internet, all working as unpaid couriers. nobody at any of them did anything wrong. that is the problem.

button one: Continue with Microsoft (device code)

Push says the page requests a device code from the Kali365 kit and shows it in a “Confirm access” dialog with copy instructions. the “Open Microsoft” button opens the real Microsoft device login page, login.microsoftonline.com/common/oauth2/deviceauth, in a pop-up. the victim pastes the code, signs in, approves, and Microsoft issues tokens to the operator’s Kali365 session.

read that again. the sign-in page is genuine. the domain is genuine. MFA is genuine and completes normally. the victim is authorizing someone else’s session, and every “check the URL bar” training slide on earth says this looks fine.

then, for a second helping, the lure page shows “Signed in as …, opening Microsoft 365” and forwards the victim to a VoidProxy Microsoft sign-in page that Push says captures the password and session cookie too. tokens and a password. belt and suspenders, but for theft.

button two: Continue with Google (AiTM proxy)

per Push, this opens a pop-up titled “Portal” on continue-to-event.claudewebinnar[.]com, a VoidProxy reverse proxy that relays Google’s real sign-in flow while capturing the password, the MFA response, and the session cookie. classic adversary-in-the-middle. the user does everything right and the session cookie leaves anyway.

yes, the OpenAI-branded page uses a Google proxy with “claude” in the domain. Push also found a “Same as Claude” code comment on an earlier page and concludes the operator clones lures from older ones without fully rebranding. even phishers have a copy-paste tech debt problem.

who is behind it

Push separates three layers, and it is worth keeping them separate:

• Kali365 and VoidProxy are separate phishing-as-a-service platforms, both built to bypass or defeat MFA. Push says it has seen nothing linking their developers and thinks this operator is most likely a paying customer of both.
• ZoomMock (fake Zoom event pages, May to October 2026) and MSDRoot (the newer event pages, from October 22) are Push’s names for the operator’s own lure kits.
• Push rates the link between ZoomMock and MSDRoot as medium-high. the two kits share no code. the main evidence is a shared domain: register.rsvpconnect-events[.]com served a ZoomMock page until October 20, and anthropic.rsvpconnect-events[.]com served the first MSDRoot page on October 22, with the same custom Cloudflare challenge on the domain on October 12 and October 29.

Push also points to earlier reporting it considers related: ANY.RUN on July 15 describing “partner summit” lures for Meta, OpenAI, and Anthropic on real Zoom event pages, and Cofense on October 29 describing invitations from “Austin from nthropic,” missing A and all, sent through GoTo Webinar’s mailer.

indicators (defanged, from Push)

Push’s own caveat: the operator rotates domains every few weeks, so these are mostly useful for hunting back through proxy and DNS logs, not for blocking forward. the eventrsvp[.]app domain was three days old when Push looked at it on November 2.

URL pattern Push documented for the current lures: hxxps://<brand>.eventrsvp[.]app/event/<brand>/id<11 digits>/rsvp/, with /live/ and /join/ variants. Push’s post has the full ZoomMock-era list.

what actually stops this

Push sells a browser product and, unsurprisingly, says its browser product stops it. fine. here is what you can do with what you probably already own:

• kill device code flow for people who do not need it. in Microsoft Entra, Conditional Access can restrict the device code authentication flow. almost nobody in marketing needs to sign in a TV or a CLI tool. the ones who do can be an exception group with a name and an owner.
• phishing-resistant MFA (passkeys or FIDO2 security keys) for Google and Microsoft accounts. they are bound to the real site’s origin, so an AiTM proxy on a different domain does not get a usable assertion. push notifications and codes do not have that property, which is the whole business model of VoidProxy.
• hunt your sign-in logs for device code authentications by users who have never used one, and for sessions whose IP or ASN changes right after a sign-in. that second one is what a stolen cookie looks like from the inside.
• hunt DNS and proxy logs for the indicators above going back to May, because ZoomMock was running then.
• tell people the rule in one line: real vendors do not give away paid subscriptions or stock for signing into a webinar with your work account. the SpaceX share is not real. it was never going to be real.

the sloth’s take

the industry spent five years telling users “look for the padlock,” then “check the domain,” then “turn on MFA.” this campaign shows a real Microsoft domain, a real Google sign-in flow, and a completed MFA prompt, and still walks off with the account. the advice was not wrong. it was just written for a threat model that retired. the only control in this story that the attacker cannot route around with a better pop-up is an authenticator that checks the origin for you. buy those. stop buying posters.

if you are not sure whether device code flow is open to your whole tenant, or which users still approve push prompts on a guess, that is a short review with a long payoff. Book a slot with Dark Edge Consulting.

sources

• Push Security, “Analyzing a fake event campaign combining AiTM and device code phishing payloads” (Luke Jennings, November 5, 2026)
• BleepingComputer, “Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts” (Lawrence Abrams, November 5, 2026, secondary coverage)