Phishing attacks on businesses are getting harder to spot, and a wave of campaigns targeting Microsoft and Google accounts is a sharp reminder of that. Attackers are now impersonating major, trusted brands — OpenAI and SpaceX among them — to lure employees into fake event pages designed to harvest login credentials. For small and medium businesses, the stakes are high: one stolen account can unlock email, file storage, payroll systems, and customer data.
How the Fake Event Scam Actually Works
The mechanics are straightforward, which is part of what makes them so dangerous. Criminals set up convincing landing pages that mimic invitations to webinars, product launches, or exclusive briefings tied to high-profile brands like OpenAI or SpaceX. These are names that carry real authority right now — the kind of invitation an employee might genuinely expect to receive.
When a victim clicks through and attempts to register or sign in, they're presented with a fake Microsoft or Google login page. The page looks legitimate. The URL might even be close enough to the real thing that a quick glance doesn't raise alarm. Once the victim enters their credentials, those details are captured instantly and fed to the attacker — often in real time.
Some of these campaigns also use what's known as an adversary-in-the-middle proxy, which means the fake site sits between the victim and the real login page, capturing not just the password but also the session token that proves the user has already authenticated. That lets attackers bypass multi-factor authentication entirely, because they're stealing the proof of login rather than trying to guess a code.
Why SMBs Are a Prime Target for These Campaigns
Large enterprises have dedicated security teams watching for unusual login activity around the clock. Most small and medium businesses don't. That gap is exactly what attackers exploit. A compromised Microsoft 365 or Google Workspace account at an SMB can sit undetected for days or weeks, giving criminals time to read emails, impersonate staff, pivot to connected systems, or quietly exfiltrate data.
There's another layer to consider. Stolen business credentials don't always get used immediately by the person who stole them. Often, they're packaged into infostealer logs or credential dumps and sold on dark web markets. By the time your team notices something is wrong, the credentials may have changed hands multiple times. The original phishing campaign might be months old.
This is why waiting for an obvious incident — a locked account, a fraudulent transaction — is not a viable security strategy for any business that relies on cloud tools.
What You Can Do Right Now to Reduce Your Exposure
The first line of defence is awareness. Employees should be trained to treat any unexpected login prompt with suspicion, especially one that arrives via email or social media linked to an event invite. If someone asks you to sign in with your Microsoft or Google account to access something, pause. Go directly to the official website of the brand in question and verify the event exists.
Beyond awareness, there are technical measures worth implementing. Hardware security keys or passkeys offer much stronger protection than standard authenticator apps, because they're tied to the legitimate domain and can't be intercepted by a fake site in the way that one-time codes can. Where passkeys aren't yet supported, push-based MFA is still better than nothing.
Access policies also matter. Limiting which applications and services employees can connect to their corporate Microsoft or Google accounts reduces the blast radius if an account is ever compromised. Conditional access rules — restricting logins to known devices or locations — add another layer.
How Breachrr Helps You Spot Credential Theft Early
Awareness and policy changes help prevent new incidents, but they don't tell you whether your credentials have already been exposed. At Breachrr, we continuously monitor breach databases, infostealer dumps, dark web markets, public code repositories, and domain infrastructure for signs that your business data has been compromised. If an employee's login credentials turn up in a stealer log or a leaked database, you'll know before an attacker has the chance to use them.
Phishing attacks on businesses are only growing in sophistication. The brands being impersonated will keep changing — today it's OpenAI and SpaceX, tomorrow it will be someone else. What stays constant is that stolen credentials end up in the same places, traded through the same underground channels. That's exactly where Breachrr is watching.
Find out whether your business credentials are already exposed. Run a free audit at breachrr.com/audit.
Want to see if your company is exposed?