Push Security published on 5 November 2026 that in late October 2026 it detected and blocked visits to fake event registration pages advertising an OpenAI Academy livestream, a private SpaceX briefing on "SpaceX AI for Marketing," and Anthropic at AWS re:Invent.

Push says each page asks the visitor to sign in with a work account to claim a reward (three months of ChatGPT Pro, three months of Grok Heavy, or a "SpaceX share"), and that "Continue with Microsoft" starts a Microsoft device-code login through the Kali365 phishing-as-a-service platform then hands the visitor to a VoidProxy Microsoft sign-in page for a second capture, while "Continue with Google" opens a VoidProxy reverse proxy of Google's sign-in page. Push tracks the operator's lure kits as ZoomMock (fake Zoom event pages from May to October 2026) and MSDRoot (newer event pages starting on 22 October), running on subdomains of eventrsvp[.]app behind a Cloudflare challenge, with invitation links via Google or Zapier shorteners and earlier waves via GoTo Webinar or legitimate Zoom event pages.

Push says Kali365 and VoidProxy are separate PhaaS platforms designed to bypass or defeat MFA checks. (source: Push Security)

BleepingComputer reported the same campaign on 5 November 2026, noting Microsoft and Google credentials and authentication sessions as the targets. (source: BleepingComputer)