Employée devant un ordinateur portable, illustrant une fausse invitation à un événement qui mène à de l'hameçonnage

Fake OpenAI and SpaceX invitations: the fake event phishing that bypasses MFA

The invitation looks legitimate: an OpenAI online event on ChatGPT for marketing teams, or a private SpaceX briefing on AI, with three months of a premium subscription for attendees. All you have to do is register with your work account. That is exactly the trap Push Security described on November 5, 2026: a fake event phishing campaign that steals Microsoft 365 and Google Workspace accounts, even ones protected by MFA.

Here’s the annotated trap page, the two attack paths, the signs to spot and the settings to change.

Fake event phishing: the annotated page

1🔒 at.eventrsvp.app/event/…/rsvp

Online event · November 4

ChatGPT for Social & Digital Marketing Teams

Livestream · limited seats

2🎁 3 months of ChatGPT Pro for attendees — work account required

3⊞ Continue with Microsoft

4G Continue with Google

What’s wrong

1The address doesn’t belong to OpenAI. The attackers rotate domains every few weeks, so a “clean” address proves nothing.
2A reward that’s too good, tied to a work account. A real event doesn’t need your company access to give you a seat.
3The Microsoft button shows you a code to type on Microsoft’s real page. Typing it authorizes the attacker’s device.
4The Google button opens a window that relays the real Google sign-in and keeps a copy: password, MFA code and session.

Mockup rebuilt from public descriptions by Push Security and BleepingComputer; no live link. Before reaching this page, the victim often goes through a well-known link shortener (Google, Zapier) and a fake “I’m not a robot” check that keeps security tools from scanning it.

Two buttons, two ways to steal your account

You

Microsoft path (Kali365)

Google path (VoidProxy)

1→ You click “Continue with Microsoft” or “Continue with Google”.

2→ The page shows a code and opens the real microsoft.com/devicelogin page.

3→ You type the code, sign in and approve with your usual MFA.

4⚠ Microsoft hands access tokens to the attacker: they get into your mailbox, files and connected apps, without your password.

5⚠ Then a fake Microsoft page asks for your password again: a second capture.

6⚠ On the Google side, a “Portal” window relays the real sign-in and captures the password, MFA response and session cookie.

Both paths get around classic MFA (text, code or push). It’s the same idea as in our article on TA419’s “AI committee” phishing: the attacker doesn’t just steal a password, they steal a session that’s already signed in.

Signs to spot in 10 seconds

🎟️

A webinar doesn’t need access to your Microsoft 365 to sign you up.

🔢

A code to type somewhere else

If a site gives you a code to enter at microsoft.com/devicelogin, stop. You never need that for an event.

🎁

A free premium reward

Free subscription, “SpaceX share”, exclusive access: that’s the bait.

🤖

A robot check before the page

Here it hides the page from security tools; it isn’t protecting you.

🔗

A shortened link

The real link hides behind a shortener. Go through the organizer’s official site instead.

⏳

Limited seats, close date

Urgency pushes you to sign in without thinking.

Settings to change on the company side

Setting	Before	After
Device code sign-in (Microsoft Entra ID)	Allowed for everyone	Blocked by Conditional Access, except for devices that truly need it (meeting rooms, for example)
MFA	Text or push notification	FIDO2 security keys or passkeys, which resist phishing
Third-party apps	Employees can authorize anything	Admin approval for new apps
Sessions after a suspicious click	Only the password is changed	All sessions and tokens for the account are revoked too
Alerts	Nobody watches sign-ins	Automated 24/7 monitoring with on-call technician response on unusual sign-ins

Clicked? What to do right now

In order, without waiting

☐ Tell your IT contact right away, even if you’re not sure you typed the code.
☐ Change the account password from a safe device.
☐ Revoke all sessions (Microsoft Entra ID or Google Workspace admin console): a password change alone won’t kick out a stolen token.
☐ Check mailbox rules: automatic forwarding or rules that hide messages.
☐ Review authorized apps and devices registered to the account, and remove anything you don’t recognize.
☐ Warn your colleagues: the same invitation was probably sent to others.

How NeoTech can help

We block device code sign-in where it isn’t needed, roll out phishing-resistant MFA, train your staff to recognize these invitations and respond fast when an account is hit. See our cybersecurity services.

Book your free cyber check

In 30 minutes, we check with you whether device code sign-in is open in your Microsoft 365, what kind of MFA your staff use and what would happen if an account were stolen tomorrow.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Our office: 2572 boul. Daniel-Johnson, office 237, Laval.

Sources

Photo: Christina Morillo, Pexels (Pexels licence).