Heads up: Push Security report.
Fake OpenAI and SpaceX event invites are after your work login
Checked
Who this protects: anyone in your family with a work email account, especially people who work in marketing. The one action: never sign in from an invite. Open the real company's website yourself.
Talk about it at home: jump to the Table Talks
A fake invitation to a private SpaceX briefing on Nov 12 offers three months of Grok Heavy or a "SpaceX share." To claim it, the page asks you to sign in with your work Microsoft or Google account. That sign-in is the trap.
What researchers found
On Nov 5, 2026, the security firm Push Security published research on fake event registration pages posing as OpenAI, SpaceX and Anthropic. Push said it detected and blocked visits to these pages on its customers' browsers in late October 2026. BleepingComputer reported the research the same day.
- OpenAI: a page copied the look of the OpenAI Academy events site. It advertised a Nov 4 livestream, "ChatGPT for Social & Digital Marketing Teams," and offered 3 months of ChatGPT Pro.
- SpaceX: a page advertised an invite-only "Starship Product Briefing" on Nov 12, about SpaceX AI for marketing and Grok. Visitors could pick 3 months of Grok Heavy or a "SpaceX share."
- Anthropic: a page posed as an Anthropic session at AWS re:Invent. It was no longer live when Push investigated.
Each page said a work account was required. Push said the invitations arrive by email and aim at marketing staff. OpenAI, SpaceX and Anthropic are the brands being copied. They are not the ones running the scam.
Why the sign-in is the trap
The pages show two buttons, "Continue with Microsoft" and "Continue with Google." They look like the sign-in buttons on many real sites. Push found that behind them sit rented phishing tools built to capture work logins. BleepingComputer reported that this kind of access can reach a person's work email and the other work apps tied to that login.
Two details make this one harder to spot:
- The code on your phone may not stop it. Push said both tools are designed to get around multifactor authentication, the extra code or tap that usually protects an account. Keep it turned on. It still blocks many attacks. It is just not enough on its own here.
- A familiar sign-in page is not proof the invite is safe. If a site you reached from an invite hands you a code to type into a Microsoft or Google page, stop. Close it and open the real site yourself.
The pages also sat behind a "Confirm you're not a robot" check, and the invite links passed through short links on well-known sites. Push said both help the pages slip past security scanners. A robot check or a familiar-looking link does not make a page safe.
Why AI is the bait
"Employees want access to the latest AI tools, making them excellent bait for attacks," Push wrote. It added that AI tools now make convincing copycat pages easier to build.
Push said the same operator switched from Zoom themes to Anthropic, OpenAI, SpaceX and Claude themes between Oct 20 and Oct 30, changes web addresses every few weeks, and likely runs more lures than the ones Push has seen. The next invite may use a different company name. The pattern stays the same: a big AI brand, a reward, and a work login.
How to check an invite
- Don't sign in from the invite. Google's Gmail Help says that if you click a link and are asked for a password, don't enter it. Go directly to the website you want to use.
- Open the real site yourself. Type the address (openai.com, spacex.com, anthropic.com, or grok.com for Grok) or open the official app, and look for the event there. CISA gives the same advice: search for the site or type the address yourself if you're sure you know it.
- Ask your IT team. If an event is real and your company wants you there, someone at work can confirm it quickly.
- Report it. In Gmail, open the message, choose More, then Report phishing. In Outlook, choose Report message or Junk, then Phishing.
Our rule of thumb: if an invite wants your work login, close it.
Do this now: tell anyone in your family with a work email what this invite looks like: a big AI brand, a reward, and a "Continue with Microsoft" or "Continue with Google" button.
If you already signed in
Tell your IT team right away, even if nothing looks wrong. Microsoft advises contacting your IT admin if you're on a work computer and changing your passwords right away. These tools can grab the session that keeps you signed in, so ask IT to sign the account out everywhere too. If it was a personal Google account, check your recent security activity at myaccount.google.com/notifications. If you shared card or bank details, call your bank. You can report scams to the FTC at ReportFraud.ftc.gov.
Table Talks (10 minutes)
- Has anyone here signed up for a webinar or event through work or school? How did the sign-up work?
- Why would a scammer offer an AI tool or a "share" instead of cash?
- A page says "Continue with Google." Can you tell from the page alone whether it is safe? What would you do instead?
- Shared activity: pick one company your family likes (an AI app, a sports team or an employer). Together, type its web address yourself and find its real events or news page. Talk about how that is different from tapping a link in an email. Do not sign in to anything on screen.
- Family action: agree on one sentence and say it out loud: "If an invite wants my login, I close it and ask." Your kids can use the same rule with their school accounts.
Education only, not financial, legal or tax advice. Not a registered investment adviser.
Sources
Primary sources
- Push Security (Luke Jennings): Analyzing a fake event campaign combining AiTM and device code phishing payloads, Nov 5, 2026, date checked: Nov 10, 2026
- CISA: Recognize and report phishing, consumer guide, date checked: Nov 10, 2026
- Google Gmail Help: Avoid and report phishing emails, help page, date checked: Nov 10, 2026
Supporting links
- BleepingComputer (Lawrence Abrams): Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts, Nov 5, 2026, date checked: Nov 10, 2026
- Microsoft Learn: How to protect against phishing attacks, help page, date checked: Nov 10, 2026