A coordinated phishing campaign is leveraging fabricated invitations to technology industry events to compromise corporate authentication systems, according to research disclosed by Push Security. The operation chains together two separate phishing-as-a-service offerings—Kali365 and VoidProxy—to target both Microsoft and Google account holders through distinct attack vectors designed to bypass security controls.
The attackers construct convincing event registration portals that dangle incentives such as complimentary premium AI service access. When targets interact with these pages, they encounter prompts to authenticate using their work accounts. The infrastructure behind these pages integrates Kali365 to execute Microsoft device code phishing attacks, while VoidProxy functions as an adversary-in-the-middle proxy to intercept Google authentication flows and exfiltrate session cookies.
Push Security identified and blocked malicious registrations to these pages in late October 2026. The campaign represents an escalation of tactics previously documented by ANY.RUN in July, when similar operations abused legitimate Zoom event pages to distribute fake Meta, OpenAI, and Anthropic event promotions. Cofense has also tracked related phishing emails impersonating Anthropic events that leveraged GoTo Webinar's infrastructure to redirect victims through multiple intermediary sites before landing on fraudulent registration portals.
Fake AI events lead to account phishing
The distribution mechanism for phishing links remains partially unclear, though Push Security observed that attackers route victims through shortened URLs from trusted services including Google and Zapier. Earlier iterations of the campaign also utilized GoTo Webinar email systems and legitimate Zoom event pages as distribution channels.
Researchers identified two custom phishing kits—designated ZoomMock and MSDRoot—that generate the fraudulent event pages and subsequently direct victims to the Kali365 and VoidProxy services. The shared infrastructure and targeting patterns suggest the same threat actors operate both toolkits.
The impersonated events include an OpenAI gathering titled "ChatGPT for Social & Digital Marketing Teams" advertising three months of ChatGPT Pro access; a private SpaceX event scheduled for November 12 offering either three months of Grok Heavy or a "SpaceX share"; and an Anthropic event at AWS re:Invent 2026, which has since been removed.
The fake pages present a Cloudflare CAPTCHA challenge before revealing the registration interface, a technique that prevents automated security scanners from analyzing the phishing site. Once victims proceed, they encounter two authentication pathways: "Continue with Microsoft" and "Continue with Google."
Attack mechanics: Device codes and session hijacking
When a victim selects the Microsoft option, the phishing page invokes Kali365 to generate a Microsoft device authentication code. This exploits the legitimate OAuth 2.0 device authorization grant flow to obtain authentication tokens for the victim's Microsoft Entra account without requiring direct password disclosure. The stolen tokens grant access to connected resources and SSO applications including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian.
Victims are instructed to copy the code and enter it on Microsoft's official device login website, where they authenticate and approve the request. This step allows Kali365 to capture the authentication tokens. Following successful device code authentication, the page redirects the victim to a VoidProxy-hosted Microsoft login interface, where attackers can additionally harvest passwords and session cookies.
The Google authentication path operates differently. Selecting this option opens a pop-up window containing a Google login page proxied through VoidProxy. The platform functions as an adversary-in-the-middle, intercepting login forms between the victim's browser and Google's servers to steal credentials, multifactor authentication responses, and session cookies.
Both Kali365 and VoidProxy enable attackers to circumvent multifactor authentication by capturing already-authenticated sessions or, in the device code scenario, bypassing MFA entirely.
Defensive measures
Organizations and employees can implement several protective strategies. Employees should refrain from entering Microsoft device authentication codes sourced from unfamiliar websites and exercise skepticism toward event invitations requiring corporate account sign-in to claim rewards. Organizations should disable device code authentication in contexts where it serves no operational purpose and deploy phishing-resistant MFA solutions such as FIDO2 security keys to mitigate session hijacking risks.