A recent phishing campaign delivers fake event registration pages via email invitations, targeting employees with lures for OpenAI, SpaceX, and Anthropic. The attack uses short links and open redirects from trusted services to evade reputation-based checks before leading victims to spoofed event sites. These pages impersonate legitimate corporate events and promise rewards like premium software access or equity. The primary risk is the compromise of corporate credentials and session tokens, as the campaign specifically targets marketing staff who are motivated to access new artificial intelligence tools. The initial access vector relies on social engineering rather than malware, making traditional endpoint defenses less effective against the initial click.
The attack chain begins with a Cloudflare managed challenge that hides the lure from automated scanners. Once the visitor passes this check, they encounter a page that mimics a real event site and offers two sign-in options. Selecting the Microsoft option initiates a device code flow through a phishing-as-a-service platform, which captures the authentication token before redirecting the user to a second proxy page that steals the password and session cookie. The Google option opens a reverse proxy that relays the entire sign-in process, capturing the password, multi-factor authentication response, and session cookie in real time. The operator uses distinct kits to build these pages, rotating domains frequently to avoid detection. The collection server receives all stolen data, while the proxy services handle the complex task of bypassing multi-factor authentication checks by intercepting the legitimate authentication handshake between the user and the service provider.[/subscribe_to_unlock_form]
A recent phishing campaign delivers fake event registration pages via email invitations, targeting employees with lures for OpenAI, SpaceX, and Anthropic. The attack uses short links and open redirects from trusted services to evade reputation-based checks before leading victims to spoofed event sites. These pages impersonate legitimate corporate events and promise rewards like premium software access or equity. The primary risk is the compromise of corporate credentials and session tokens, as the campaign specifically targets marketing staff who are motivated to access new artificial intelligence tools. The initial access vector relies on social engineering rather than malware, making traditional endpoint defenses less effective against the initial click.
The attack chain begins with a Cloudflare managed challenge that hides the lure from automated scanners. Once the visitor passes this check, they encounter a page that mimics a real event site and offers two sign-in options. Selecting the Microsoft option initiates a device code flow through a phishing-as-a-service platform, which captures the authentication token before redirecting the user to a second proxy page that steals the password and session cookie. The Google option opens a reverse proxy that relays the entire sign-in process, capturing the password, multi-factor authentication response, and session cookie in real time. The operator uses distinct kits to build these pages, rotating domains frequently to avoid detection. The collection server receives all stolen data, while the proxy services handle the complex task of bypassing multi-factor authentication checks by intercepting the legitimate authentication handshake between the user and the service provider.[emaillocker id="1283"]
The campaign demonstrates a rapid evolution in lure themes, shifting from Zoom to various AI brands within a single month. The operator likely runs additional lures beyond those observed, as evidenced by leftover code references to other brands in the page source. This active development and domain rotation indicate a persistent threat that adapts quickly to takedowns. Defensive implications suggest that organizations must look beyond static blocklists and focus on behavioral detection at the browser layer. Monitoring for unusual device code requests and reverse proxy interactions provides a more robust defense against these identity-based attacks that bypass traditional perimeter controls.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Initial Access | T1566.003 | Phishing | Spearphishing via Service |
| Initial Access | T1566.005 | Phishing | Spearphishing via Voice |
| Initial Access | T1566.006 | Phishing | Spearphishing via Video |
| Initial Access | T1566.007 | Phishing | Spearphishing via Image |
| Initial Access | T1566.008 | Phishing | Spearphishing via Audio |
| Initial Access | T1566.009 | Phishing | Spearphishing via Text |
| Initial Access | T1566.010 | Phishing | Spearphishing via Video |
| Credential Access | T1557.001 | Adversary-in-the-Middle | LLM Prompt Injection |
| Credential Access | T1557.002 | Adversary-in-the-Middle | Device Code Phishing |
| Credential Access | T1566.004 | Phishing | Credential Harvesting |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Credential Access | E1056 | Input Capture |
| Command and Control | B0030 | C2 Communication |
| Exfiltration | E1020 | Automated Exfiltration |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Defense Evasion | F0004 | Disable or Evade Security Tools |
| Communication Micro-objective | C0002 | HTTP Communication |
| Execution | E1204 | User Execution |
The following reports contain further technical details:
[/emaillocker]