Fake OpenAI and SpaceX Event Invites Target Work Accounts

Fake invitations to events supposedly hosted by OpenAI, SpaceX and Anthropic are being used to lure workers towards phishing pages designed to capture Microsoft and Google work accounts. The campaign is a reminder that a polished registration page and a familiar technology brand are not proof that an invitation is genuine.

Security company Push Security said on 5 November that it detected and blocked visits to the pages in late October. Its researchers found OpenAI- and SpaceX-branded event pages asking visitors to sign in with a work account to claim promotional rewards. An Anthropic-themed variant had also been seen, although it was no longer live when the team investigated.

The pages imitate a normal event registration journey. One advertised an OpenAI Academy livestream and offered three months of ChatGPT Pro. Another promoted an invite-only SpaceX briefing and offered a choice of rewards. Both presented Microsoft and Google sign-in options, turning a seemingly routine RSVP into an attempt to gain access to a corporate identity.

Push says the Microsoft route used a device-code phishing service known as Kali365, while the Google route used VoidProxy, an adversary-in-the-middle service. Those methods are significant because they can go beyond collecting a password. A device-code flow can trick a user into authorising an attacker-controlled session, while a proxy can capture authentication material during a real-looking sign-in. Multi-factor authentication remains important, but it does not automatically defeat every phishing method.

The researchers did not establish that OpenAI, SpaceX or Anthropic systems were compromised. Their brands were being impersonated. Nor does the report quantify how many accounts were taken over. It documents observed lure pages and the phishing infrastructure behind them, rather than a confirmed breach of those companies.

Staff should verify invitations by visiting an organiser’s official site directly instead of following an unexpected registration link. A request to use a work account to unlock a giveaway is a particularly useful pause point. Security teams should review sign-in logs for unusual device-code approvals, unfamiliar sessions and unexpected OAuth activity, then revoke suspect sessions and reset affected credentials where necessary.

Push also observed the operator changing brands and domains quickly and using redirects and browser checks that can frustrate automated scanners. That makes awareness training alone insufficient. Organisations need identity monitoring, phishing-resistant authentication where available, and a clear route for employees to report suspicious invitations without fear of blame.

As TechBooky has reported in a separate Microsoft account attack, social engineering can exploit legitimate identity flows. The broader lesson is not to avoid technology events. It is to treat the sign-in step as a security decision, especially when an invitation promises an unusually valuable reward. BleepingComputer’s report provides additional context on the campaign.