Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts

Hackers are conducting phishing campaigns using fake event invitations impersonating high-profile organizations such as OpenAI, SpaceX, and Anthropic. The attacks target employees and aim to steal Microsoft and Google account credentials along with authentication session tokens. Two different phishing-as-a-service (PhaaS) platforms are being leveraged to carry out these attacks at scale. The lure of prestigious tech events makes these invitations particularly convincing to potential victims. By stealing session cookies in addition to credentials, attackers can bypass multi-factor authentication protections. The campaign highlights the growing sophistication and commoditization of phishing infrastructure available to threat actors.