Skip to content
Scammers.com
PhishingReviewed

Fake OpenAI and SpaceX event invites on eventrsvp.app, plus an Anthropic lure on rsvpconnect-events.com, phish Microsoft and Google work accounts

Fake OpenAI and SpaceX event invites on eventrsvp.app, plus an Anthropic lure on rsvpconnect-events.com, phish Microsoft and Google work accounts, according to Push Security.

First reported
Reports
1

Source: pushsecurity.com · published

Illustration: Phishing, texts and email scams

What happened

On 5 November 2026 Push Security published an analysis of fake event registration pages for OpenAI, SpaceX and Anthropic that phish Microsoft and Google work accounts. According to Push, the OpenAI and SpaceX pages run on subdomains of eventrsvp.app, while an Anthropic lure was served on anthropic.rsvpconnect-events.com and was no longer live when Push investigated. The pages use the Kali365 kit against Microsoft accounts and VoidProxy against Google accounts.

How the scam works

Push says it detected and blocked customer-browser visits to these fake registration pages in late October 2026. The OpenAI and SpaceX flows sit on brand.eventrsvp.app paths with event identifiers, plus /live/ and /join/ variants. Continuing often opens a Portal pop-up or a Continue with Microsoft / Google button that leads to a reverse-proxy sign-in page. For Google, Push observed a VoidProxy host such as continue-to-event.claudewebinnar.com that relays Google's real sign-in and captures the password, MFA response and session. For Microsoft, a Kali365 device-code Confirm access dialog and VoidProxy-style hosts such as continue-to-office-.ggleventapi.icu capture passwords and session cookies. Telemetry was sent to an operator collection server at an eventrsvp-labelled sslip.io address on 217.60.102.48.

Work-account takeover lets criminals read email, reach cloud files and launch further internal phishing. Push's advice is to treat unexpected executive or vendor event invites with suspicion, hover links before clicking, and prefer official calendars. Anyone who signed in should reset passwords, revoke sessions and tell their IT security team. OpenAI, SpaceX and Anthropic are the spoofed brands in the lures, not accused operators. These are Push Security's findings; scammers.com has summarised them and not independently verified the infrastructure beyond the published analysis.

Source

Push Security, AI-themed fake event campaign analysis, 5 November 2026. Not independently verified by scammers.com.

Red flags

  • Event invites for OpenAI, SpaceX or Anthropic on domains such as eventrsvp.app or rsvpconnect-events.com.
  • A Continue with Microsoft or Google button on an unofficial registration page.
  • A Portal pop-up or device-code Confirm access prompt after RSVP.
  • Sign-in pages on hosts such as claudewebinnar.com or ggleventapi.icu.
  • Unexpected executive or AI-summit invites that bypass your normal calendar process.

If you were targeted

  1. 1Do not sign in to Microsoft or Google from an event-RSVP link you were not expecting.
  2. 2Type vendor sites yourself or use official calendars instead of email links.
  3. 3If you entered work credentials, reset the password, revoke sessions and tell IT security immediately.
  4. 4Report the invite and URLs to your security team.
  5. 5Treat lookalike RSVP domains as high risk.
ReportFraud.ftc.gov FBI IC3 More resources