Fake OpenAI, SpaceX, and Anthropic Event Lures Fuel AiTM Phishing Campaigns Targeting Microsoft and Google Accounts — Detection and Hardening Guide

---
title: Suspicious OAuth Consent Grant Following Phishing Campaign Activity
id: 4f2c8a1e-6b9d-4e7a-9c31-2a5d7f8b0e12
status: experimental
description: Detects user consent grants to newly registered or unverified OAuth applications in Entra ID, a common persistence and data-access step after AiTM phishing-driven session theft. Correlates with fake OpenAI/SpaceX/Anthropic lure campaigns targeting Microsoft accounts.
references:
  - https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.credential_access
  - attack.t1550.001
  - attack.persistence
logsource:
  product: azure
  category: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add delegated permission grant'
  filter_known_apps:
    TargetResources|contains:
      - 'Microsoft'
      - 'Office 365'
  condition: selection_operation and not filter_known_apps
falsepositives:
  - Legitimate third-party SaaS onboarding by users; tune with an allowlist of approved application names in your tenant
level: high
---
title: Browser Launch of Lookalike AI Company Phishing Domains
id: 8e1b3d47-5c2a-4f68-b1d9-7c4e6a0f2d35
status: experimental
description: Detects browser processes navigating to lookalike domains abusing OpenAI, Anthropic, or SpaceX branding on non-official top-level infrastructure, consistent with fake event invitation phishing lures delivering AiTM credential and session theft pages.
references:
  - https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_lure:
    CommandLine|contains:
      - 'openai-event'
      - 'openai.events'
      - 'spacex-event'
      - 'spacex.events'
      - 'anthropic-event'
      - 'anthropic.events'
      - '-invite'
      - 'event-registration'
  filter_official:
    CommandLine|contains:
      - 'openai.com'
      - 'spacex.com'
      - 'anthropic.com'
  condition: selection_browser and selection_lure and not filter_official
falsepositives:
  - Rare; internal marketing pages using similar URL slugs. Validate against a list of sanctioned campaign domains.
level: high

// Hunt: Sign-ins consistent with AiTM session-token replay following delivery
// of AI/space-themed event lure emails. Joins Defender for Office email events
// with Entra sign-ins showing a new device and new ASN within a short window.
// Tune the time window and lure keywords to your environment.
let LureWindow = 24h;
let LureKeywords = dynamic(["openai", "spacex", "anthropic", "event", "invite", "registration"]);
let LureRecipients =
    EmailEvents
    | where TimeGenerated > ago(LureWindow)
    | where Subject has_any (LureKeywords)
    | where SenderFromDomain !in ("openai.com", "spacex.com", "anthropic.com")
    | where DeliveryAction == "Delivered"
    | extend Recipient = tolower(RecipientEmailAddress)
    | project EmailTime = TimeGenerated, Recipient, SenderFromDomain, Subject, NetworkMessageId;
SigninLogs
| where TimeGenerated > ago(LureWindow)
| where ResultType == 0
| extend Recipient = tolower(UserPrincipalName)
| join kind=inner LureRecipients on Recipient
| where TimeGenerated between (EmailTime .. EmailTime + 6h)
| extend DeviceDetail = tostring(DeviceDetail)
| project SignInTime = TimeGenerated, Recipient, IPAddress, Location,
          AppDisplayName, UserAgent, DeviceDetail, AuthenticationRequirement,
          SenderFromDomain, Subject, RiskLevelDuringSignIn
| order by SignInTime desc

// Hunt: Session replay indicators — successful sign-ins from ASNs/locations
// never before seen for the user, with token/cookie-based auth (no interactive
// MFA claim), typical of stolen session reuse after AiTM phishing.
let Lookback = 30d;
let Recent = 2d;
let KnownLocations =
    SigninLogs
    | where TimeGenerated between (ago(Lookback) .. ago(Recent))
    | where ResultType == 0
    | summarize by UserPrincipalName, AutonomousSystemNumber = tostring(NetworkLocationDetails), Location;
SigninLogs
| where TimeGenerated > ago(Recent)
| where ResultType == 0
| extend ASN = tostring(NetworkLocationDetails)
| where not(UserPrincipalName in~ (KnownLocations | project UserPrincipalName)
    and ASN in~ (KnownLocations | project AutonomousSystemNumber))
| where AuthenticationRequirement == "singleFactorAuthentication" or isnotempty(TokenProtectionStatus)
| project TimeGenerated, UserPrincipalName, IPAddress, ASN, Location,
          AppDisplayName, UserAgent, AuthenticationRequirement,
          TokenProtectionStatus, RiskLevelDuringSignIn
| order by TimeGenerated desc

-- Hunt browser history artifacts for visits to AI/space-themed phishing
-- lure domains (fake OpenAI/SpaceX/Anthropic event pages) across endpoints.
-- Parses Chrome/Edge History SQLite databases for suspicious URL patterns
-- while excluding the legitimate vendor domains.
LET history_files = SELECT FullPath
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/History',
  'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/History'
])

SELECT FullPath AS HistoryDB,
       url.URL AS VisitedURL,
       url.title AS PageTitle,
       timestamp(epoch=url.last_visit_time / 1000000 - 11644473600) AS VisitTimeUTC
FROM foreach(
  row=history_files,
  query={
    SELECT FullPath, url.url AS URL, url.title, url.last_visit_time
    FROM sqlite(file=FullPath,
                query='SELECT url, title, last_visit_time FROM urls')
    AS url
    WHERE (url.URL =~ '(?i)openai|spacex|anthropic'
       OR url.URL =~ '(?i)(event|invite|registration)')
      AND url.URL !~ '(?i)(^|//|\.)(openai\.com|spacex\.com|anthropic\.com)'
      AND url.URL =~ '(?i)(event|invite|registr|briefing|webinar|rsvp)'
  })
ORDER BY VisitTimeUTC DESC

# AiTM Phishing Response & Entra ID Hardening Script
# Run with an account holding Global Admin or Privileged Role Admin + Cloud App Admin.
# Requires: Microsoft.Graph PowerShell SDK (Install-Module Microsoft.Graph)

# 1. Connect with the scopes needed for session revocation and consent auditing
Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All","RevokeSession.All","AuditLog.Read.All","Policy.ReadWrite.ConditionalAccess"

# 2. REVOKE active sessions for suspected compromised users (stolen tokens die here)
# Replace with your confirmed/affected user list from the KQL hunts above
$affectedUsers = @("user1@contoso.com","user2@contoso.com")
foreach ($u in $affectedUsers) {
    Revoke-MgUserSignInSession -UserId $u
    Write-Host "[+] Sessions revoked for $u" -ForegroundColor Green
}

# 3. AUDIT recent OAuth consent grants (persistence check after session theft)
$since = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
  Where-Object { $_.ActivityDisplayName -in @("Consent to application","Add service principal","Add delegated permission grant") } |
  Select-Object ActivityDateTime, ActivityDisplayName,
    @{n='InitiatedBy';e={$_.InitiatedBy.User.UserPrincipalName}},
    @{n='TargetApp';e={($_.TargetResources | Select-Object -First 1).DisplayName}} |
  Format-Table -AutoSize

# 4. VERIFY Conditional Access token protection is enforced (blocks session replay)
Get-MgIdentityConditionalAccessPolicy |
  Where-Object { $_.State -eq "enabled" } |
  Select-Object DisplayName,
    @{n='TokenProtection';e={$_.SessionContext -match 'tokenProtection'}} |
  Format-Table -AutoSize

# 5. CHECK for users still on legacy / non-phishing-resistant MFA
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { $_.IsMfaRegistered -eq $true -and $_.MethodsRegistered -notcontains "windowsHelloForBusiness" -and $_.MethodsRegistered -notcontains "fido2" -and $_.MethodsRegistered -notcontains "passkey" } |
  Select-Object UserPrincipalName, MethodsRegistered |
  Export-Csv -Path ".\NonPhishingResistantMFAUsers.csv" -NoTypeInformation
Write-Host "[!] Review .\NonPhishingResistantMFAUsers.csv for phishing-resistant MFA rollout targets" -ForegroundColor Yellow

# 6. REMOVE suspicious mailbox forwarding rules created post-compromise (per user)
# Connect-ExchangeOnline
# Get-InboxRule -Mailbox "user1@contoso.com" | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.DeleteMessage -eq $true } | Format-List