Fake OpenAI and SpaceX Events Are Stealing Your Microsoft and Google Accounts

Robert Moore · 2026-11-05

You get an invite to an exclusive OpenAI event. Or maybe a SpaceX launch party. Sounds exciting, right? That's exactly what hackers are counting on. They're using fake event invitations from OpenAI, SpaceX, and Anthropic to trick employees into handing over their Microsoft and Google account credentials. And they're doing it with some seriously sneaky tools. ### How the Scam Works The phishing attacks are run through two different phishing-as-a-service platforms. These platforms make it easy for even low-level criminals to set up convincing fake login pages. The invitations look real—they mimic the branding of these high-profile tech companies. Once you click, you're taken to a page that looks like a Microsoft or Google sign-in. But it's not. It's a trap to steal your username, password, and even your authentication session. ### Why These Companies? OpenAI, SpaceX, and Anthropic are hot topics. People are curious. They want to know what's happening next in AI and space exploration. Hackers exploit that curiosity. They know employees are more likely to click on something that seems related to these innovative companies. Plus, these invitations often promise exclusive access or insider information—too good to pass up. ### The Rise of Phishing-as-a-Service Phishing-as-a-service (PhaaS) platforms are a growing problem. They provide everything a cybercriminal needs to launch a phishing campaign: templates, hosting, and even analytics. The two platforms used in these attacks are particularly concerning because they offer advanced features like session token theft. That means even if you have two-factor authentication enabled, the attackers can bypass it by stealing your session cookie. ### How to Protect Yourself - **Think before you click**: If you receive an invitation to an event from a company you don't have a relationship with, be skeptical. Verify the sender's email address carefully. - **Check the URL**: Before entering any credentials, make sure the URL is legitimate. Phishing sites often use slight misspellings or unusual domains. - **Enable two-factor authentication (2FA)**: While not foolproof, 2FA adds an extra layer of security. But remember, session token theft can bypass it, so stay vigilant. - **Use a password manager**: A good password manager will only autofill credentials on the correct domain, alerting you to potential phishing sites. - **Stay informed**: Follow security news and updates from trusted sources. Knowing about current scams helps you spot them. ### What This Means for Antidetect Browser Users If you're using antidetect browsers to manage multiple accounts, you're already aware of privacy risks. But phishing attacks like these can compromise even the most careful users. Always ensure you're on the correct website before logging in. Antidetect browsers can help mask your fingerprint, but they can't protect you from yourself if you fall for a phishing scam. Stay sharp. > The best defense against phishing is a healthy dose of skepticism. If something feels off, it probably is. ### The Bottom Line Hackers are getting more sophisticated. They're using fake events to steal credentials and session tokens. Don't let curiosity get the better of you. Verify everything, and keep your accounts secure. Remember, the next invite you get might not be what it seems.