As reported by BleepingComputer, a newly uncovered phishing campaign weaponizes the public's appetite for AI events—impersonating OpenAI, SpaceX, and Anthropic—to harvest corporate Microsoft and Google credentials and sessions. What elevates this beyond routine credential phishing is the deliberate fusion of two phishing-as-a-service (PhaaS) platforms—Kali365 and VoidProxy—into a single kill chain that simultaneously targets the two most ubiquitous enterprise identity providers on the planet.
Why the Dual-Platform Design Matters
The campaign's architecture is its defining feature. By pairing Kali365's device code phishing with VoidProxy's adversary-in-the-middle (AiTM) reverse proxy, the attackers don't just intercept passwords—they capture the authentication artifacts that follow successful MFA. Device code phishing exploits OAuth device flow to obtain access tokens without a password. AiTM proxying intercepts the full session post-authentication. The Microsoft leg uses both stages in sequence, meaning even organizations that enforce phishing-resistant MFA may find their tokens already in attacker hands by the time a user completes sign-in.
The threat isn't a better lure—it's a better harvest. By targeting session artifacts rather than credentials, the attackers sidestep MFA entirely and persist access until token lifetimes expire or are revoked.
Abuse of Trusted Distribution Channels
The campaign's distribution vector deserves equal scrutiny. Redirects flow through Google and Zapier URL shorteners and have previously leveraged GoTo Webinar's email infrastructure and legitimate Zoom event pages. Each hop adds a layer of perceived legitimacy that traditional email gateway filtering struggles to flag. Security awareness training that tells users to 'check the URL' collapses when the initial link originates from a trusted SaaS platform the organization itself uses.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Audit device code flow telemetry: In Microsoft Entra ID, review sign-in logs for device code flow completions originating from unexpected geolocations or unfamiliar IP ranges. Alert on device code grants outside normal usage patterns.
- Tighten conditional access: Require compliant device or hybrid Azure AD join for authentication. Block legacy authentication protocols entirely. Implement session controls that limit token lifetimes and require reauthentication for high-risk actions.
- Revive and shorten session lifetimes: For Google Workspace, configure context-aware access and review session persistence settings. Reduce refresh token lifetimes for non-managed devices.
- Block or rewarm shortened URLs: Proxy or sandbox traffic resolving through popular URL shorteners. Flag Google and Zapier shortener domains for additional inspection in email and web gateways.
- Hunt for indicators of compromise: Search authentication logs for sign-ins from the VoidProxy infrastructure. Push Security's report provides indicators; integrate them into your SIEM and EDR detection rules.
Strategic Measures
- Deploy phishing-resistant MFA: FIDO2 security keys or Windows Hello for Business resist both device code and AiTM interception. Push-notification and OTP-based MFA do not.
- Expand awareness training scope: Train employees that legitimate AI vendors do not require corporate SSO sign-in for event registration. Any 'sign in with Microsoft/Google to attend this AI event' flow is a red flag.
- Monitor PhaaS kit evolution: Track Kali365, VoidProxy, ZoomMock, and MSDRoot indicators. These kits are commercial and will recur across campaigns with different lures.
This campaign is a case study in phishing maturity: the lure exploits cultural momentum (AI hype), the distribution exploits trusted infrastructure, and the payload exploits authentication protocol design. Defenders who treat this as just another phishing email will miss the session-token theft that matters. Those who treat it as an identity security problem—governing tokens, sessions, and OAuth flows—will be positioned to detect and contain it.
