Hackers use fake OpenAI, SpaceX, and Anthropic event invites in new phishing scam to steal Microsoft and Google accounts (www.techradar.com)

Security researchers have uncovered a new phishing scam that exploits the growing interest in AI by using fake event invitations from major companies like OpenAI, SpaceX, and Anthropic to steal corporate login credentials. Attackers are leveraging sophisticated techniques including device-code phishing and reverse proxies, specifically targeting Microsoft and Google accounts. Victims lured by promises of free access to AI tools are directed to fraudulent websites that prompt them to log in, unwittingly sharing their credentials with the hackers. This attack is significant for the AI/ML community as it highlights how emerging technologies are being exploited in social engineering schemes. The campaign employs phishing-as-a-service platforms like Kali365 and VoidProxy, which allow attackers to bypass multi-factor authentication (MFA) and capture sensitive session data. As AI tools become more integrated into daily workflows, the tactics of threat actors are evolving to capitalize on the enthusiasm surrounding these technologies, necessitating a heightened awareness and improved security measures within organizations to combat such sophisticated phishing attempts.