Hacking groups are exploiting the growing interest in artificial intelligence developments and events organized by companies operating in this field to develop fraud methods targeting employees and their corporate accounts.
Hot Topics
Through fake invitations to attend exclusive conferences and meetings bearing the names of companies such as OpenAI, SpaceX, and Anthropic , attackers lure their victims to fake login pages, not intended to confirm participation, but to steal login data, authentication tokens, and take over account sessions.
With a printed sheet or a blurry image, intelligent robots are tricked into carrying out dangerous orders.
Cybersecurity firm Push Security revealed in a report published Thursday that a phishing campaign uses two platforms, Kali365 and VoidProxy, to target Google and Microsoft accounts .
The company explained that the attackers not only collect passwords, but also use techniques that target the authentication mechanisms themselves, allowing them to access accounts even when they are protected by additional layers of identity verification.
The campaign begins with emails and invitations promoting events that appear to be linked to well-known artificial intelligence companies, and offers targets promises of participation in private meetings or obtaining exclusive benefits.
Bosch Security detected a page impersonating the OpenAI Academy, advertising an event about using GPT chat in marketing teams, with an offer of a free 3-month subscription to the GPT Chat Pro service. Researchers also discovered a page using the SpaceX name to promote a private briefing on the Starship project and AI applications in marketing, enticing visitors with a subscription to the Grok Heavy service or a share of the company's stock.
The enticement tactics extended to impersonating Anthropic and promoting an event linked to the AWS re conference. In all these cases, the goal was to get the visitor to log in using a work account via Google or Microsoft, under the pretext of completing registration or receiving the advertised reward.
To lend credibility to these pages, the attackers used shortened links from well-known services, including Google and Zapier, along with techniques that mimic real event registration pages. This hides the final destination of the link and makes it more difficult to distinguish between the genuine invitation and the fraudulent message.
How do hackers take over accounts?
The campaign relies on various techniques to target Microsoft and Google accounts, taking advantage of the Kali 365 and VoidProxy platforms, which provide tools to carry out phishing attacks.
In targeting Microsoft accounts, attackers use device code phishing. The fake page asks the user to copy a code and enter it on Microsoft's official authentication page, supposedly to confirm their identity or complete registration. However, the code is linked to a login process initiated by the attacker. Once entered and the request is accepted, the attacker can obtain access and update codes, allowing them to use the account and its associated services with the victim's privileges.
Tags:
technology
