Researchers at security firm Push Security have mapped a phishing campaign that uses spoofed registration pages for events hosted by OpenAI, SpaceX and Anthropic. The attackers target business Microsoft and Google accounts and lure employees with rewards such as free subscriptions to ChatGPT Pro or Grok Heavy.
Push Security describes the attackers’ methods in an analysis of the AI-themed fake event campaign. According to the researchers, victims receive an email invitation containing shortened links that redirect via trusted domains belonging to Google, Zapier and X, among others. In this way, the attackers attempt to evade filters that check for suspicious domains.
According to Push Security, anyone who clicks the link first lands on a fake Cloudflare verification page. This page blocks automated security scanners, keeping the actual phishing page hidden from tools that analyse URLs. Only then is the visitor shown the spoofed event page, which is designed to resemble the official pages of the companies concerned.
Signing in with a work account
On the fake pages, visitors are asked to sign in with their work account to watch a livestream or claim a reward. The researchers say that how the sign-in buttons work depends on the platform selected.
If a user chooses ‘Continue with Microsoft’, the Kali365 phishing platform displays a code that must be entered on Microsoft’s official device login page. As soon as the user approves the code, the attackers gain access to the account. The victim is then redirected to a second fake page, which also harvests the password and session cookie via VoidProxy.
The ‘Continue with Google’ button opens a pop-up window running on VoidProxy. This platform acts as an adversary-in-the-middle (AiTM) reverse proxy. It relays Google’s genuine sign-in process to the user while simultaneously intercepting the password, the multi-factor authentication (MFA) code and the session tokens. With these tokens, an attacker can hijack a session without having to complete the MFA step again.
One operator behind multiple kits
Push Security reports that the landing page kits, which the researchers have named ZoomMock and MSDRoot, come from the same operator. This operator rents Kali365 and VoidProxy as a service to bypass MFA. The attacker therefore does not need to develop the technology for intercepting credentials themselves.
According to the researchers, the attackers rapidly rotate domains and brand themes and make use of legitimate cloud infrastructure. Push Security argues that blocklists and URL filters therefore often fall short. The company, which itself provides browser-level security, advocates in-browser detection that analyses a page’s behaviour as it loads.
Points for administrators to consider
The campaign combines two techniques, both aimed at bypassing MFA: abuse of Microsoft’s device code flow and the interception of session tokens via a reverse proxy. Administrators of Microsoft 365 environments would therefore do well to check whether the device code flow is needed within their organisation. Using Conditional Access, you can restrict or block this authentication method. Phishing-resistant forms of MFA, such as FIDO2 keys and passkeys, are bound to the domain on which they are registered and therefore do not work via an AiTM proxy.
The campaign also shows that attackers are capitalising on interest in AI services. Rewards such as free subscriptions to ChatGPT Pro or Grok Heavy are a recognisable pattern that you can include in security awareness training for employees.
The full report can be read in the analysis of the AI-themed fake event campaign.
This article was originally published in Dutch on MSP Business. Read the original →
