Insights Security & Privacy
Fake AI event invitations are stealing work logins: how to stay safe
The short version
Fake invitations to AI events offer free premium tools or rewards, but ask you to sign in with your work account. Doing so gives attackers access to your Microsoft or Google account, even if you use two-step sign-in.
What happened
Security firm Push Security found fake registration pages posing as OpenAI, SpaceX and Anthropic events. One promised three months of ChatGPT Pro. Another, for a private SpaceX event on 12 November, offered three months of Grok Heavy or a "SpaceX share". Each page says a work account is needed to claim the reward.
The page offers "Continue with Microsoft" or "Continue with Google". The Microsoft route asks you to copy a code into Microsoft's real login page. That approves the attacker's access without your password. The Google route opens a fake sign-in window that relays what you type and captures your session.
The links pass through trusted services, such as Google and Zapier short links, and a robot check hides the pages from scanners.
Why it matters to you
Because the attackers capture an already approved session, the usual two-step sign-in code does not stop them. Once inside, they can reach email, files and other tools linked to the same login.
The bait is aimed at staff who want to try the latest AI tools, and the pages are made to look like real brands. A familiar name or a trusted short link is no longer proof that an invitation is genuine.
What to do
Be wary of signing in through an event invitation link, and avoid entering a Microsoft device code that a website gave you. Be cautious of any invitation that asks for a work login to claim a reward.
If you or a colleague already signed in, tell whoever manages your accounts. Businesses can restrict device code sign-in where it is not needed and use phishing-resistant security keys (FIDO2).
Sources
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.