A sophisticated phishing campaign is currently leveraging high-profile corporate themes, including fake OpenAI, SpaceX, and Anthropic events, to simultaneously compromise Microsoft and Google accounts. Security researchers have identified a “multimodal” approach where attackers chain disparate Phishing-as-a-Service (PhaaS) platforms—specifically Kali365 and VoidProxy—to target multiple cloud ecosystems within a single campaign.
The operation represents a significant evolution in social engineering, moving away from generic login pages toward highly specific lures. One recent variant targets social media and digital marketing teams with invitations to a fake OpenAI livestream titled “ChatGPT for Social & Digital Marketing Teams,” originally advertised for November 4, 2026. These lures often promise “ChatGPT Pro” rewards or exclusive access to new AI models to entice employees into clicking malicious registration links.
Dual-Track Exploitation: Kali365 and VoidProxy
The campaign is notable for its tactical split, using different infrastructure depending on the target account type. For Microsoft environments, the attackers utilize the Kali365 platform to conduct “Device Code Phishing.” This method is particularly dangerous because it bypasses traditional security training that teaches users to “check the URL.”
In a device code attack, the phishing site instructs the user to visit the legitimate microsoft.com/devicelogin page and enter a specific code. Because the user is interacting with a genuine Microsoft domain, standard URL-filtering defenses often fail. Once the user enters the code and authenticates, they unwittingly authorize the attacker’s device to access their corporate tenant, effectively bypassing Multi-Factor Authentication (MFA).
For Google accounts, the campaign switches to VoidProxy. This platform operates as an Adversary-in-the-Middle (AiTM) reverse proxy. When a victim attempts to “Register with Google” on the fake event page, VoidProxy sits between the user and the legitimate Google login service. It captures the user’s credentials and, more importantly, the session cookies in real-time. These intercepted cookies allow attackers to clone the authenticated session and bypass MFA without needing the user’s password for subsequent logins.
Infrastructure Shift to MSDRoot
Analysis of the campaign’s infrastructure reveals a recent transition in the kits used to build the fraudulent registration pages. Between May and October 2026, the attackers primarily utilized the “ZoomMock” kit to create fake webinar landing pages. However, as of October 22, 2026, telemetry from Push Security indicates a shift toward the “MSDRoot” kit.
This transition suggests the threat actors are actively rotating their toolkit to evade detection by security providers who have blocked earlier ZoomMock-associated domains. The newer MSDRoot pages continue to impersonate SpaceX and Anthropic, often using “Grok Heavy” access or SpaceX “share” programs as fraudulent incentives to capture corporate credentials.
Organizations can defend against these tactics by monitoring tenant logs for unauthorized device code requests and implementing FIDO2-based hardware security keys, which are generally resistant to the AiTM proxy methods used by platforms like VoidProxy. Security teams should also verify any “ChatGPT Pro” or corporate event invitations that require authentication through third-party “registration” sites, even if they eventually redirect to legitimate login portals.
