Safety · 2026-11-07

Fake OpenAI and SpaceX Events Lure Users With Gifts to Steal Work Accounts

Scammers disguise phishing sites as OpenAI, SpaceX, and Anthropic events, promising free ChatGPT Pro, but actually try to steal Microsoft and Google work accounts.

✨ How the scam works

Criminals created sites that look like event pages from OpenAI, SpaceX, and Anthropic. One invited people to a webinar on using ChatGPT in marketing and promised three months of ChatGPT Pro for free.

To get the gift, people were asked to sign in with their work Microsoft or Google account. This is where the danger begins.

📌 What happens to your account

For the attack, scammers combined two phishing platforms: Kali365 and VoidProxy. The first gets access to Microsoft through authorization codes, and the second intercepts login data and active sessions.

With Microsoft, the site shows a code and asks you to enter it on the real Microsoft sign-in page. If you do, attackers can obtain a token, a digital key that gives access to the account without a password.

With Google, a window appears that looks like a normal sign-in page. A fraudulent system sits between you and Google and intercepts your password, two-factor codes, and session data. The biggest risk is that attackers can get in without repeating the verification.

🔹 What is at risk

Your work email and any service you access through your corporate account may be exposed.

Researchers have not yet determined how these invitations are distributed. In earlier similar attacks, scammers used genuine Zoom event pages and GoTo Webinar emails.

🔸 How to protect yourself

Be wary of any invitation that offers a gift in exchange for signing in with your work account, especially if the site asks you to copy a code and enter it on a Microsoft page.

Companies are advised to restrict code-based sign-in where employees don't need it, and to use phishing-resistant login methods such as FIDO2 hardware security keys.

A similar scheme previously used free Telegram Premium subscriptions: people received 'birthday greetings' and an offer of three months of Premium. The scammers likely got birthdates from leaked databases linked to phone numbers.

Sources: 🔗 DOU/dev.ua