[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSufqf7GBGSf8cPsGd_bipUaVyYfm-Rbg8cTdSutEmd0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":46},"ccf6fbd8-a17d-44ba-9970-3d95ee2639a4","venom-phishing-campaign-targets-c-suite-with-advanced-mfa-bypass","426773b1-bc3d-4143-90b8-f30a0cc3e341","VENOM Phishing Campaign Targets C-Suite with Advanced MFA Bypass","The VENOM phishing campaign demonstrates how threat actors are evolving their tactics to specifically target high-value executive accounts using sophisticated techniques that bypass traditional security controls. By combining personalized social engineering, QR code obfuscation, and adversary-in-the-middle attacks, the attackers successfully circumvented multi-factor authentication—a security control many organizations consider bulletproof. The campaign's focus on senior executives highlights the critical need for enhanced security awareness training at the C-level, as these accounts typically have elevated privileges and access to sensitive business information. The use of Base64 encoding and closed-access platforms shows how attackers are adapting to evade detection systems and security logging.","**Immediate actions:**\n- Deploy executive-focused phishing simulation campaigns targeting QR code and SharePoint impersonation attacks\n- Implement conditional access policies requiring device compliance and trusted locations for executive accounts\n- Enable advanced threat protection with QR code scanning capabilities in email security solutions\n\n**Long-term improvements:**\n- Establish privileged access management (PAM) solutions with time-limited access for executive accounts\n- Deploy phishing-resistant authentication methods like hardware security keys or certificate-based authentication\n- Create executive-specific security awareness programs addressing advanced persistent threats\n\n**Detection measures:**\n- Monitor for unusual sign-in patterns and device registrations on high-privilege accounts\n- Implement user and entity behavior analytics (UEBA) to detect anomalous access patterns\n- Enable detailed audit logging for all executive account activities and authentication events",[12,13,14,15,16,17],"CIS Control 14","NIST AC-2","NIST AC-3","NIST AT-2","NIST IA-2","GDPR Article 32",{},"published","2026-04-09T22:09:09.350661+00:00","2026-04-09T22:09:09.23+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-venom-phishing-attacks-steal-senior-executives-microsoft-logins\u002F","new-venom-phishing-attacks-steal-senior-executives-microsoft-logins-4fa879","New VENOM phishing attacks steal senior executives' Microsoft logins",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[40],{"id":41,"date":42,"edition":43,"title":44,"audio_url":45},"714b0cbb-42f0-4c49-ba31-f2788a43c914","2026-04-10","morning","ThreatNoir Morning Brief — April 10","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-10\u002Fthreatnoir-morning-brief-2026-04-10.mp3",[47,51,55],{"slug":48,"name":49,"problem":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]