New VENOM phishing attacks steal senior executives' Microsoft logins
VENOM phishing-as-a-service platform targets C-suite Microsoft credentials with AiTM and device-code attacks.
Threat actors operating a previously undocumented phishing-as-a-service platform called VENOM have been targeting senior executives (CEOs, CFOs, VPs) across multiple industries since November 2025. The campaign uses highly personalized phishing emails impersonating Microsoft SharePoint, Unicode-rendered QR codes to bypass scanning tools, and employs adversary-in-the-middle (AiTM) and device-code phishing tactics to bypass MFA and establish persistent account access. Researchers at Abnormal Security note that the closed-access platform avoids public exposure and uses sophisticated techniques like Base64-encoded email addresses in URL fragments to evade server-side logging and reputation feeds.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe VENOM phishing campaign demonstrates how threat actors are evolving their tactics to specifically target high-value executive accounts using sophisticated techniques that bypass traditional security controls. By combining personalized social engineering, QR code obfuscation, and adversary-in-the-middle attacks, the attackers successfully circumvented multi-factor authentication—a security control many organizations consider bulletproof. The campaign's focus on senior executives highlights the critical need for enhanced security awareness training at the C-level, as these accounts typically have elevated privileges and access to sensitive business information. The use of Base64 encoding and closed-access platforms shows how attackers are adapting to evade detection systems and security logging.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — VENOM
- malware — device-code phishing