Cybercriminals are luring employees to fake OpenAI, SpaceX, and Anthropic events, promising free access to ChatGPT Pro, Grok, and other gifts. But behind the invitations is an attempt to steal corporate Microsoft and Google accounts.
Cybercriminals are luring employees to fake OpenAI, SpaceX, and Anthropic events, promising free access to ChatGPT Pro, Grok, and other gifts. But behind the invitations is an attempt to steal corporate Microsoft and Google accounts.
This is reported by Bleeping Computer.
The scammers created websites masquerading as OpenAI, SpaceX, and Anthropic event pages. For example, one of them invited people to an event about using ChatGPT in marketing. Participants were promised three months of ChatGPT Pro for free. However, in order to receive the promised gifts, visitors were asked to register using a work Microsoft or Google account.
To do this, the hackers combined two phishing platforms — Kali365 and VoidProxy. The first helps to gain access to Microsoft through authorization codes, and the second — intercepts login data and active sessions.
If you select Microsoft, the site displays a special code and asks you to enter it on a genuine Microsoft sign-in page. When the person enters it and confirms authorization, the attackers can receive a special token — a digital key that allows you to use the account without knowing the password. The victim is then redirected to another Microsoft sign-in page, where they try to intercept their password and active session data.
If you select Google, you will be presented with a login window that looks like a regular login page. However, a fraudulent system will be running between the user and Google, intercepting the password, two-factor authentication confirmation, and session data.
The latter are especially valuable for attackers, as they allow them to impersonate someone who has already successfully logged into the account, so in some cases, you can avoid having to go through verification again.
Therefore, both work email and other company services that the employee accesses through their corporate account may be at risk.
Researchers have not yet determined how the invitations are distributed in this campaign, but in previous similar attacks, attackers have used genuine Zoom event pages and GoTo Webinar email newsletters.
Experts advise to be careful with invitations where gifts are asked to log in through a work account. Especially if the site offers to copy the code and enter it on the Microsoft page. And companies are recommended to limit authorization using such codes if employees do not need it. And also to use phishing-resistant login methods, for example, physical FIDO2 security keys.
Previously, dev.ua wrote about a similar phishing scheme. Fraudsters lured users with a free Telegram Premium subscription. People were sent birthday greetings and offered to activate three months of Premium as a gift. Presumably, the attackers learned the dates of birth from the merged databases by phone numbers, because even those who did not indicate their birthday in Telegram received messages.
