Olexweb- Event invitations offering unusually generous gifts, such as three months of ChatGPT Pro, Grok Heavy, or company shares.
- Websites that require completing a Cloudflare CAPTCHA before showing you the event registration form.
- Registration forms that force you to continue by signing in with your Google or Microsoft work credentials.
- Instructions asking you to copy a code and paste it into Microsoft's official device login website.
Many freelancers, remote workers, and small business teams rely on Google Workspace and Microsoft 365 for daily operations. Falling for a fake AI promotion can expose work emails, client files, and linked tools like Slack or Salesforce. Because these attacks steal active sessions or misuse device codes, regular two-factor authentication will not protect you.
- 01Never enter a device authentication code on Microsoft's portal unless you generated it on your own device for an app you trust.
- 02Verify event links on the official websites of the hosting companies instead of clicking links from email redirects or shorteners.
- 03If you entered a code or signed in, immediately sign out of all active sessions from your Google or Microsoft security dashboard.
- 04Change your account passwords right away and inform your organization's workspace administrator.
- 05Adopt phishing-resistant security keys, such as FIDO2 hardware tokens, to defend against session hijacking.
In the source’s own words
- Attackers are using fake invitations to tech events to lure people into credential theft.“Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks”, BleepingComputer
- The phishing registration pages promise free access to paid AI tools to trick visitors.“convincing event registration pages offering free access to premium AI services and other rewards to trick victims into signing in with their corporate accounts.”, BleepingComputer
- One campaign mimicked an OpenAI event promising free subscriptions.“One phishing page advertises an OpenAI event titled "ChatGPT for Social & Digital Marketing Teams" that promises three months of ChatGPT Pro to participants.”, BleepingComputer
- The campaign uses two platforms to conduct device code and proxy attacks.“Kali365 conducts Microsoft device code phishing attacks, while VoidProxy acts as an adversary-in-the-middle (AiTM) reverse proxy to intercept Google sign-ins”, BleepingComputer
How does this attack bypass two-factor authentication?
The attack intercepts active browser session cookies via a reverse proxy or tricks you into completing a legitimate device login flow that issues an access token directly to the attacker.
What should I do if I entered a Microsoft device code?
Log into your Microsoft account security page immediately, revoke active sessions across all devices, and change your password.
Written by Olexweb in our own words, based on reporting by BleepingComputer (8 November 2026). Every fact is quoted from that source. Things change: check the source before you rely on details.