Cybercriminals are leaning hard on the AI craze, dressing up phishing schemes as exclusive events from big-name tech companies to steal Microsoft and Google logins. The bait is simple, polished and dangerous: free access, invite-only access and a registration flow that looks routine until it quietly turns into account theft.
According to security researchers, the campaign uses fake event pages that imitate OpenAI, SpaceX and Anthropic, then pushes workers toward sign-in prompts that can hand over corporate access. The setup is slick enough to slip past a quick glance, which is exactly why it works so well. Once someone gets pulled in by the promise of premium AI perks, the next clicks can open the door to credentials, authentication tokens and session hijacking.
The lure starts with an invitation that sounds like a dream deal. One fake OpenAI event promoted a livestream about marketing teams and dangled three months of ChatGPT Pro, while another page posed as a SpaceX briefing with rewards tied to Grok Heavy or a share-style prize. A separate page pretended to be an Anthropic event tied to AWS re:2026, showing how easily attackers can swap brands while keeping the same basic trap in place.
What makes the scam especially slippery is how much effort goes into making it look normal. Visitors are sent through familiar services and familiar-looking layers before they ever reach the fake registration page. Security checks that seem routine, like human verification prompts, can also be part of the trick, helping the criminals slow down scanners while the page continues to look legitimate to a real person.
For Microsoft users, the attack can become especially nasty. Some victims are told to copy a device code into Microsoft’s real sign-in page, which can make the process feel safe because the site itself is genuine. But the request was started by the attacker, not the user, and that can lead to authentication tokens being issued to the wrong session.
That matters because a stolen token can give access without ever needing the password again. In some cases, the attack chain does not stop there, either. Researchers say the flow may push users into a second phishing layer designed to harvest passwords and session cookies, which can keep an intruder inside Microsoft 365 and other connected workplace tools.
The Google side of the scheme works with the same kind of confidence game. A pop-up can appear to be a real Google sign-in screen while quietly routing the login through a phishing service that sits in the middle and watches the exchange. From there, credentials, multifactor responses and session cookies can be captured and reused.
That’s what makes these campaigns so frustrating. People hear “multifactor authentication” and assume the account is locked down tight, but session theft can sidestep the usual comfort zone. A cookie that proves a user already signed in can become a shortcut straight into the account, which is why these attacks are so attractive to criminals who know how modern logins work.
The fake event pages also keep evolving to stay ahead of detection. Some versions adapt to a visitor’s language automatically, which helps the same scam reach different regions without requiring a completely new setup each time. Researchers also found that multiple phishing kits and services appeared to be working together, giving the operators more ways to rotate infrastructure when one piece gets exposed.
What should stand out here is the old-school manipulation underneath the shiny AI packaging. The scam counts on excitement, urgency and a little bit of greed, because a free premium subscription or invite-only event can make people move fast. That split-second impatience is often all the criminals need, especially when the page looks polished and the sign-in screen feels familiar.
The safest move is to slow everything down. Unexpected invitations should be checked through official company channels, not by clicking the message that arrived in the inbox. If a registration page asks for work credentials, a device code or any sign-in that feels off, that is the moment to stop, not the moment to push through.
It also helps to remember that a clean-looking address or a padlock icon does not prove the page is trustworthy. Attackers know how to borrow the look and feel of legitimate services, then hide the actual danger one click deeper. Good security habits still matter, especially strong account protection, phishing-resistant sign-in options and software that can flag suspicious pages before the damage spreads.
If a fake event page was already opened, the response should be immediate and specific. Close it, report it through the proper channels and bring in IT or security staff if any credentials, codes or sign-in approvals were entered. The faster the report, the better the odds of cutting off tokens, sessions and other access before the attacker has time to settle in.
