How do fake AI event invitations steal your Google or Microsoft session, and how do you spot one?

Fake calendar invitations — an “OpenAI Academy” session, a private SpaceX briefing — link to reverse-proxy pages in front of the real Google or Microsoft sign-in. You sign in on what looks like the genuine page, and the proxy keeps your live session, no password needed. Here is how the theft works and the six steps that stop it.

The invitation looks real: a calendar hold for an “OpenAI Academy” session, or a private SpaceX briefing, with a tidy link to join. The trap is not the meeting — it is the sign-in page the link opens.Short answer: these fake invitations link to a reverse-proxy page that sits in front of the genuine Google or Microsoft sign-in. You see the real page because the proxy fetches it live.

You type your password and approve the prompt — and the proxy keeps your live session token, the digital “I am already signed in” pass your browser holds. The attacker does not need your password at all; they walk in on your session, which is why this works even on accounts with two-factor authentication switched on.Why it matters: a stolen password can be changed in a minute. A stolen session is already inside — mail, files, chats and every app that trusts that sign-in — until the session expires or somebody revokes it.

The threat round-up for the week ending Nov. 8, 2026 flags exactly this pattern, with fake AI-event and private-briefing invitations aimed squarely at work accounts.Spot it and shut it down:1. Never sign in from an invitation link.

Close it, open Google or Microsoft yourself — type the address or use your own app or bookmark — and sign in there.2. Treat calendar invites from strangers like email from strangers. A genuine event never requires you to “verify access” by signing in through its link, and manufactured urgency (“private briefing,” “limited seats”) is the tell.3.

Check who sent it and where the link really goes before tapping anything.4. Review your active sessions regularly: in Google, open your account’s Security section and look at signed-in devices; in Microsoft, review your account’s sign-in activity and devices. Sign out anything you do not recognize.5.

Revoke first, ask questions later: if a session looks wrong, end it everywhere and change the password.6. Keep passkeys or two-factor authentication on. They stop most attacks cold — just do not treat them as armor against a stolen live session.Common mistake: assuming a page that looks pixel-perfect must be real.

A proxy serves the real page; the address bar, and how you arrived there, are what give it away.