[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNUqcXo5KAiO6DatppakdAOjG9g7f7wTKFxSaWt9U7XI":3},{"article":4,"iocs":44,"watch_terms":50,"solutions":51,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"426773b1-bc3d-4143-90b8-f30a0cc3e341","New VENOM phishing attacks steal senior executives' Microsoft logins","new-venom-phishing-attacks-steal-senior-executives-microsoft-logins-4fa879","Threat actors using a previously undocumented phishing-as-a-service (PhaaS) platform called \"VENOM\" are targeting credentials of C-suite executives across multiple industries. [...]","Threat actors operating a previously undocumented phishing-as-a-service platform called VENOM have been targeting senior executives (CEOs, CFOs, VPs) across multiple industries since November 2025. The campaign uses highly personalized phishing emails impersonating Microsoft SharePoint, Unicode-rendered QR codes to bypass scanning tools, and employs adversary-in-the-middle (AiTM) and device-code phishing tactics to bypass MFA and establish persistent account access. Researchers at Abnormal Security note that the closed-access platform avoids public exposure and uses sophisticated techniques like Base64-encoded email addresses in URL fragments to evade server-side logging and reputation feeds.","VENOM phishing-as-a-service platform targets C-suite Microsoft credentials with AiTM and device-code attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-venom-phishing-attacks-steal-senior-executives-microsoft-logins\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F09\u002F03\u002FAI-Hacker.jpg","2026-04-09T21:37:04+00:00","2026-04-09T22:00:22.636197+00:00",9,[17,20,23,25],{"name":18,"type":19},"VENOM","campaign",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Abnormal Security",{"name":26,"type":27},"Phishing-as-a-Service (PhaaS)","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,47],{"type":32,"value":18,"context":46},"Phishing-as-a-service platform targeting C-suite Microsoft credentials",{"type":32,"value":48,"context":49},"device-code phishing","Tactic used within VENOM to trick victims into approving rogue device access",[21,24],{"controls":52,"vendors":133},[53,81,107],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":75,"vendor_name":21,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":82,"name":83,"problem":84,"products":85},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[86,94,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":95,"product_name":96,"url":97,"description":98},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":108,"name":109,"problem":110,"products":111},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":75,"vendor_name":21,"vendor_logo":76,"product_slug":129,"product_name":130,"url":131,"description":132},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[134,140],{"slug":135,"name":136,"logo_path":137,"roles":138},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png",[139],"reported_by",{"slug":75,"name":21,"logo_path":76,"roles":141},[142],"affected",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":154},"venom-phishing-campaign-targets-c-suite-with-advanced-mfa-bypass","VENOM Phishing Campaign Targets C-Suite with Advanced MFA Bypass","The VENOM phishing campaign demonstrates how threat actors are evolving their tactics to specifically target high-value executive accounts using sophisticated techniques that bypass traditional security controls. By combining personalized social engineering, QR code obfuscation, and adversary-in-the-middle attacks, the attackers successfully circumvented multi-factor authentication—a security control many organizations consider bulletproof. The campaign's focus on senior executives highlights the critical need for enhanced security awareness training at the C-level, as these accounts typically have elevated privileges and access to sensitive business information. The use of Base64 encoding and closed-access platforms shows how attackers are adapting to evade detection systems and security logging.",[148,149,150,151,152,153],"CIS Control 14","NIST AC-2","NIST AC-3","NIST AT-2","NIST IA-2","GDPR Article 32",{}]