Affected Systems

Employees at organizations using Microsoft Entra (Azure AD) and Google Workspace accounts. Campaign targets corporate credentials via fake event invitations impersonating OpenAI, SpaceX, and Anthropic. Phishing infrastructure uses Kali365 (device code phishing) and VoidProxy (AiTM reverse proxy) PhaaS platforms. Detected late October 2026.

Exploitation Status

Active campaign detected and blocked in late October 2026 by Push Security. Attackers use established PhaaS platforms (Kali365, VoidProxy) with custom phishing kits (ZoomMock, MSDRoot). Similar campaigns documented by ANY.RUN (July 2026) and Cofense. Distribution via Google/Zapier URL shorteners, GoTo Webinar email infrastructure, and legitimate Zoom event pages.

Business Impact

Attackers gain full access to corporate Microsoft and Google accounts, including authentication tokens and session cookies that bypass MFA. Compromised Microsoft Entra tokens grant access to SSO-connected applications (Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian). Session hijacking enables persistent access even after password changes. High risk of data theft, lateral movement, and business email compromise.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block known Kali365 and VoidProxy phishing infrastructure domains identified by Push Security; monitor for connections to these PhaaS platforms in proxy and firewall logs
  • Disable Microsoft device code authentication (OAuth 2.0 device authorization flow) in Azure AD/Entra unless explicitly required for legitimate business use cases
  • Deploy phishing-resistant MFA (FIDO2 security keys, Windows Hello for Business, or certificate-based authentication) to prevent session cookie theft and device code abuse
  • Alert users via security awareness bulletin about fake AI company event invitations requiring corporate sign-in; emphasize never entering Microsoft device codes from untrusted sources
  • Review Microsoft Entra and Google Workspace sign-in logs for unusual device code grants, OAuth consent grants, or session activity from unexpected geolocations between late October and present