Attackers are wrapping Microsoft 365 credential theft inside fake conference invitations. Registration pages for events supposedly hosted by OpenAI, SpaceX and Anthropic ask visitors to sign in with a work account to claim free AI subscriptions, then pass the session to two separate phishing services.
What happened
Push Security documented the campaign and blocked visits to the fake registration pages in late October 2026. The pages are built with two custom kits, ZoomMock and MSDRoot, and are reached through links shortened by trusted services including Google and Zapier shorteners, so the URL a victim sees looks ordinary.
Choosing the Microsoft option makes the page request a genuine Microsoft device authentication code from a phishing platform called Kali365. The visitor is told to enter that code at the real Microsoft device login page, which then issues authentication tokens to the attacker without any password being typed.
The Google option, and a second Microsoft stage, run through VoidProxy, an adversary-in-the-middle reverse proxy that relays the genuine login page and captures the password, the MFA response and the session cookie.
A Cloudflare CAPTCHA sits in front of the fake pages, which keeps automated scanning tools from inspecting them.
Who is affected
Exposure comes down to two settings, not to industry:
- Microsoft 365 or Google Workspace tenants where users are still allowed to complete device-code sign-in
- Staff who register for AI, marketing or webinar events using a corporate email address
- Tenants with no Conditional Access policy restricting device code flow or requiring phishing-resistant MFA
What to do now
Block device code authentication for every user who does not need it, then hunt for tokens issued to devices nobody recognises.
- Add a Conditional Access policy that blocks the device code flow authentication type, with a narrow exclusion group if a legitimate tool depends on it
- Require phishing-resistant MFA such as FIDO2 keys or passkeys for administrators and finance staff
- Revoke refresh tokens and reset credentials for anyone who entered a code on an unfamiliar site
- Review Entra sign-in logs for device code grants followed by unusual mailbox or file access
- Tell staff plainly that no vendor, and no free AI trial, ever needs a device code typed into a login page
What this means for South African businesses
Most South African SMEs buy Microsoft 365 Business and never touch Conditional Access, so device code flow stays open by default and this campaign needs no vulnerability at all. A single employee chasing a free ChatGPT Pro trial is enough to hand over a mailbox, and the proxy stage means the usual "we have MFA" reassurance does not hold. My read is that the exposure here is wider than any unpatched firewall story this week, because it requires no technical weakness, only a convincing invitation.
Source: BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.