Analyzing a fake event campaign combining AiTM and device code phishing payloads

In late October 2026, Push detected and blocked visits to fake event registration pages on customer browsers. The pages advertise an OpenAI Academy livestream, a private SpaceX briefing on "SpaceX AI for Marketing," and Anthropic at AWS re:Invent. Each page asks the visitor to sign in with a work account to claim a reward: 3 months of ChatGPT Pro, 3 months of Grok Heavy, or a "SpaceX share."

AI-themed lures aren't new. We've previously reported them in malvertising and ClickFix attacks, such as fake Claude install pages reached from search ads, as well as attacks involving legitimate AI tool pages in the form of shared chats, artifacts, and custom GPTs. This campaign uses them in email-delivered invitations that lead to AiTM and device code phishing, expanding the use of AI-themed lures across various payload types. Employees want access to the latest AI tools, making them excellent bait for attacks (incidentally, the creation of convincing lure pages matching real brands and pages is also made much easier with AI tools today).

Each page has two sign-in buttons. "Continue with Microsoft" starts a Microsoft device code login through Kali365. After that, it hands the visitor to a VoidProxy Microsoft sign-in page, so the operator gets a second capture. "Continue with Google" opens a VoidProxy reverse proxy of Google's sign-in page. Kali365 and VoidProxy are separate phishing-as-a-service (PhaaS) platforms, both designed to bypass or defeat MFA checks.

The event-themed pages are built by the operator of the campaign, separate from Kali365 and VoidProxy. Push tracks the kits used to build and deploy the fake event invite lure pages as ZoomMock (the fake Zoom event pages from May to October 2026) and MSDRoot (the newer event pages, starting on October 22). Each page shows the lure and sends the sign-in to Kali365 or VoidProxy.

Attack chain

The operator controls the first three stages. Kali365 or VoidProxy handles the fourth.

You can see a video of the attack below.

1. Invitation. The invitation link goes through a Google short link (c.gle or share.google) or Zapier's zpr.io. Earlier invitations came from GoTo Webinar's mail sender or from real events.zoom.us event pages. In the link we followed, an x.com logout redirect (x.com/logout?redirect_after_logout=) came before the c.gle link. Short links and open redirects on trusted domains are common techniques for evading reputation-based URL checks.

2. Bot check. A Cloudflare managed challenge protects the lure domain. Its custom page says "Confirm you're not a robot." Most public scans of the lure domains stop at this page.

3. Event page. We've seen two variants of the current event page, one for OpenAI and one for SpaceX. A third variant impersonating Anthropic was no longer live at the time we investigated, but Anthropic-linked lure pages have been reported previously (see links to previous reporting). Both run on subdomains of eventrsvp[.]app, at <brand>.eventrsvp[.]app/event/<brand>/id<11 digits>/rsvp/, with /live/ and /join/ variants.

• The OpenAI page copies the look of the OpenAI Academy events site. It advertises a livestream on November 4, "ChatGPT for Social & Digital Marketing Teams," and offers registrants 3 months of ChatGPT Pro.

• The SpaceX page advertises an invite-only "Starship Product Briefing" on SpaceX AI for marketing and Grok, on November 12. The visitor picks a reward: 3 months of Grok Heavy or a "SpaceX share."

Both pages say a work account is required and offer "Continue with Microsoft" and "Continue with Google." They run the same code and translate themselves into the visitor's language. They send each step to the operator's collection server at eventrsvp-217-60-102-48.sslip[.]io/collect.php.

4a. Continue with Microsoft: The device code lure. The page requests a device code from Kali365 and shows it in a "Confirm access" dialog, with steps to copy it. The "Open Microsoft" button opens the real Microsoft device login page, login.microsoftonline.com/common/oauth2/deviceauth, in a pop-up. The victim pastes the code, signs in, and approves. Microsoft then issues tokens to the operator's Kali365 session. The lure page then shows "Signed in as …, opening Microsoft 365" and sends the victim to a VoidProxy Microsoft sign-in page at continue-to-office-.ggleventapi[.]icu, which captures the password and session cookie.

4b. Continue with Google: The AiTM lure. The page opens a pop-up titled "Portal" on continue-to-event.claudewebinnar[.]com. This host is a VoidProxy reverse proxy. It relays Google's real sign-in flow and captures the password, the MFA response, and the session cookie.

How we identified the campaign

We rate the link between ZoomMock and MSDRoot as medium-high. The two kits share no code. Most of the evidence comes from one domain that both kits used. We observed both ZoomMock and MSDRoot on the same primary domain and so concluded the same operators are responsible.

Evidence from the shared domain:

• register.rsvpconnect-events[.]com served a ZoomMock page until October 20.

• anthropic.rsvpconnect-events[.]com served the first MSDRoot page, "Anthropic at AWS re:Invent," on October 22.

• The same custom Cloudflare challenge page was on the domain on October 12 and on October 29.

• Both kits target marketing staff with AI-brand events.

• Proxy domains for both kits use the names "continue…event" and "offcevent."

It's also worth noting that the OpenAI page sloppily contains URLs that mention Claude, such as the VoidProxy Google proxy on continue-to-event.claudewebinnar[.]com. We also identified a "Same as Claude" code comment on an earlier page, suggesting the operator builds each new lure from a copy of an earlier one and doesn't fully rebrand it. The operator likely runs more lures than the ones we've seen.

We haven't seen anything that links the Kali365 and VoidProxy developers. Both services sell subscriptions and serve many unrelated campaigns. We think this operator is most likely a customer of both.

Links to previous reporting

ANY.RUN reported on July 15 that real events.zoom.us pages carried "partner summit" lures for Meta, OpenAI, and Anthropic. The flows branched into device code phishing and AiTM phishing. Cofense reported on October 29 that invitations from "Austin from nthropic" (with the "A" missing) came through GoTo Webinar's mail sender. The links led through zpr.io and a Cloudflare check to a Zoom-style page on us968web-zoom[.]us.

Why detections can't keep up

The operator moved from Zoom to Anthropic to OpenAI, SpaceX, and Claude between October 20 and October 30. The eventrsvp[.]app domain was three days old on November 2 when we investigated it. A Cloudflare challenge hides the lure pages from scanners, and the VoidProxy Microsoft proxies show scanners real business news sites. The delivery chain uses trusted services such as zpr.io, Google short links, and X.

All of these detection evasion techniques, plus the MFA-bypassing AiTM and device code phishing payloads, mean this attack is designed to get around or through the controls that most organizations rely on to stop phishing attacks today.

How Push stops it

Push's behavioral phishing detection identifies the Kali365 device code page and the VoidProxy reverse proxy when they render, with real-time analysis. This means even fresh domains are detected and blocked, without needing to be added to known-bad blocklists.

Push can also show a warning or block on any legitimate device code login page as a second layer of defense. In Acknowledge mode, an employee who clicks through the warning creates a security alert.

Push customers do not need to take any further action.

Learn more about Push

Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.

Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.

Book a live demo to learn more.

Indicators of compromise

The operator rotates domains every few weeks, so these indicators have limited value on their own. They're most useful for hunting back through logs for earlier visits. Kali365 and VoidProxy hosts may serve other customers of those services, so read them as "used by this campaign," not "owned by this operator."

This campaign (October–November 2026)

ZoomMock (May–October 2026)