Author: Nadali. Prepared using AI.
On November 5, 2026, Push Security reported fake AI events offering rewards for work sign-ins, based on late-October observations. Researchers said approving a code on Microsoft’s real page delivered tokens to the attacker; the Google route used a sign-in proxy.
This is a security vendor’s report, not an independent Nadali test or evidence that every multifactor authentication method is equally vulnerable.
Who it helps and what to do
Small-business owners and marketing managers whose teams register for training and presentations with work accounts. The takeaway: check not only the sign-in address, but also who receives access and why.
Our recommended review:
- Verify the event on the organizer’s official website, opened separately from the invitation. A promised reward is not a reason to authorize work-account access.
- If an unfamiliar registration asks you to copy a device code and approve a sign-in, stop and refer the request to your IT contact.
- Ask an administrator whether the business needs device code flow. Microsoft recommends auditing usage first and blocking it through Conditional Access when unnecessary. Its guide calls for Report-only mode before enforcement and emergency-access exclusions to prevent administrator lockout.
- If someone already approved a suspicious request, immediately give IT the event time and invitation address so access can be investigated. This is response advice, not a claim of a confirmed breach.
Availability and limits
The Conditional Access setting applies to Microsoft Entra, not Google; an administrator must check tenant availability and licensing. Do not change company-wide policies blindly. We have not tested the attack, a tenant or a security product, and do not claim the reported pages remain active.
Sources read on November 8, 2026. Microsoft’s guidance describes an existing defensive measure, not a new release. The cover is a conceptual AI illustration, not a real interface or incident photograph.
