One phishing page runs two account-takeover attacks

Push Security reported phishing pages that run two different account-takeover techniques from a single fake event registration page. A visitor who clicks “Continue with Microsoft” gets walked through a device code attack run by a platform called Kali365. A visitor who clicks “Continue with Google” gets a pop-up adversary-in-the-middle proxy called VoidProxy. Both chains end with the attacker holding a valid session, and both survive the victim completing MFA.

The lures are AI and space company events. One page advertised an OpenAI session titled “ChatGPT for Social & Digital Marketing Teams,” offering three months of ChatGPT Pro. Another promoted a private SpaceX event on November 12, with a choice of three months of Grok Heavy or a “SpaceX share.” A third impersonated an Anthropic event at AWS re:Invent 2026 and had already been taken down when researchers found it. Each page tells the visitor they must sign in with their work account to register and claim the reward.

Before the registration page loads, the site shows a Cloudflare CAPTCHA to confirm the visitor is not a robot. That keeps automated security scanners from reaching the phishing content and classifying it. Push attributes the pages to two custom kits, ZoomMock and MSDRoot, which it believes are run by the same actors based on shared infrastructure and identical targeting. It says it detected and blocked visits to the pages in late October 2026.

The Microsoft path is a device code attack against Entra. The OAuth 2.0 device authorization grant exists for inputs where typing a password is awkward, like a TV or a CLI: one device shows a short code, the user approves it from a browser, and tokens flow back to the first device. Here the “first device” is the attacker. When the victim clicks the Microsoft button, Kali365 generates a real device code against Microsoft. The page tells the victim to copy it and enter it at Microsoft’s genuine device login site, then authenticate and approve. The victim authenticates on Microsoft’s own domain and never hands a password to the phishing site, so the flow feels clean. The tokens go to Kali365. MFA is satisfied as part of that normal sign-in, so the attacker inherits an authenticated session without facing an MFA prompt of their own.

Those tokens reach past one mailbox. A device code token for an Entra account can be used against Microsoft 365 and connected SSO applications: Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, Atlassian, and others. Device code phishing has been used before for data theft and cyberespionage.

The campaign takes more than the token. After the device code succeeds, the page redirects the victim to a VoidProxy Microsoft login page to also capture the password and session cookie. The Microsoft chain yields a token set, a password, and a live cookie from one registration.

The Google path goes straight to AiTM. Clicking the Google button opens a pop-up with a Google login served by VoidProxy. The platform sits between the browser and Google, proxies the real login forms, and relays everything through: credentials, the MFA response, and the session cookie Google issues. The victim completes a genuine Google sign-in, and the attacker keeps the resulting session.

Other researchers have documented the same pattern earlier this year. ANY.RUN reported in July that attackers abused legitimate Zoom event pages to promote fake Meta, OpenAI, and Anthropic events leading to device code and AiTM phishing. Cofense reported phishing emails impersonating Anthropic invitations, sent through GoTo Webinar’s email infrastructure and bouncing recipients through several sites to a fake registration page. The current campaign distributes its links through Google and Zapier URL shorteners. How those links first reach targets is not established.

Two controls address the mechanics directly. Restrict the device code authorization grant where you do not need it. Most users never legitimately complete a device code flow, so a conditional access policy blocking it removes the Kali365 path. For the AiTM side, phishing-resistant MFA such as FIDO2 security keys defeats VoidProxy, because the credential is bound to the real origin and a proxied login page cannot produce a valid assertion.

For users, the tell is specific: a device code you did not request, handed to you by a website, to type into Microsoft’s login page. No event registration needs that. An invitation that requires a corporate sign-in to claim free Pro access or a “share” is the same bait stated plainly.

---

Contains a referral link.