Fake AI Event Invites Target Work Accounts

How the Attack Worked

This campaign built fake event-registration pages branded as OpenAI, SpaceX, and Anthropic, inviting marketing and communications employees to sign up for high-profile events. The pages dangled rewards such as three months of ChatGPT Pro or Grok Heavy to entice victims into signing in with their workplace account instead of filling out a standard registration form. Choosing the Microsoft sign-in option triggered a device code phishing flow run through the Kali365 phishing-as-a-service platform, a technique that can be used to capture access without the victim ever entering a password directly into an attacker-controlled form.

Why It Succeeded

The lure worked because it combined a timely topic, interest in AI tools, with a tangible and believable reward. Marketing, communications, demand generation, and social media staff are routinely asked to register for industry events and evaluate new software subscriptions as part of their jobs, making the request feel ordinary. The attackers also used infrastructure designed to blend in and resist takedown: Google and Zapier short links, Cloudflare challenges, and domains that were swapped out every few weeks. This layered evasion made the campaign harder for defenders and automated filters to flag quickly.

What to Watch For

• An unsolicited invitation to an OpenAI, SpaceX, or Anthropic event that promises a free premium subscription as a reward.
• A registration process that requires signing in with a Microsoft or Google work account rather than completing a normal web form.
• Links that are shortened or pass through multiple redirect services before reaching the final registration page.
• A device code sign-in prompt appearing when you were not the one who initiated a login from a trusted application.

Building Resistance

Organizations should train employees, especially those in marketing-adjacent roles, to treat unsolicited event invitations offering free AI subscriptions as suspicious, particularly when a work-account login is requested. Employees should be taught never to complete a device code sign-in unless they personally started that login flow from a known, trusted source. Verifying event details directly through an organization's official website, rather than clicking shortened links from email or social posts, removes much of the risk this campaign relies on. Security teams can also monitor for device code authentication attempts tied to the referenced techniques, including T1566.002, T1656, and T1204.001, to catch this pattern early.

What is the fake AI event invite phishing campaign?

It is a phishing operation using fake registration pages branded as OpenAI, SpaceX, and Anthropic events that offer rewards like three months of ChatGPT Pro to get marketing employees to sign in with their work accounts.

How does the Microsoft sign-in option compromise victims?

Choosing the Microsoft sign-in option triggers a device code phishing flow run through the Kali365 phishing-as-a-service platform, which can be used to capture access.

Who is being targeted by this campaign?

Marketing, communications, demand generation, and social media employees are primary targets, along with any employees using Microsoft or Google work accounts.

How does the campaign avoid detection?

It uses Google and Zapier short links, Cloudflare challenges, and regularly changes domains every few weeks to hinder detection efforts.