Venom PhaaS Attacks (Phishing as a Service)

Venom phishing attacks refer to a newly uncovered, highly sophisticated phishing‑as‑a‑service (PhaaS) platform called VENOM, used in targeted credential‑theft campaigns against senior executives. The platform is notable for its stealth, precision targeting, and advanced MFA‑bypass techniques.

What VENOM Is

VENOM is a closed‑access PhaaS platform—not advertised on underground forums—that enables threat actors to run highly personalized phishing operations. It has been active since at least late 2025 and is used to target C‑suite executives (CEOs, CFOs, VPs, chairpersons) across more than 20 industries.

Its secrecy and selective access make it harder for researchers to track and for defenders to detect.

Who It Targets

VENOM focuses on high‑value corporate leadership, using tailored lures that mimic internal business communications. These attacks are not mass‑mailed; they are hand‑crafted for specific individuals, often using real names, company details, and fabricated email threads.

How the Attack Works (Attack Chain)

1. Highly Personalized Email Lures

• Impersonate Microsoft SharePoint document‑sharing notifications.

• Include fake email threads, multilingual text, and randomized HTML noise to evade detection.

• Contain a Unicode‑rendered QR code that shifts the attack to mobile devices, bypassing desktop email scanners.

2. QR Code → Filtering Landing Page

Scanning the QR code sends the victim to a filtering page that:

• Detects sandboxes, bots, and security scanners
• Redirects non‑targets to legitimate sites
• Sends real human targets to the credential‑harvesting platform

3. Credential Harvesting via Two Methods

A. Adversary‑in‑the‑Middle (AiTM)

• Proxies the real Microsoft login page
• Captures credentials, MFA codes, and session tokens in real time
• Registers a new device on the victim’s account for persistence

B. Device‑Code Phishing

• Tricks the victim into approving a rogue device
• Grants long‑lived OAuth tokens that survive password resets
• Increasingly popular—offered by at least 11 phishing kits

Why VENOM Is Dangerous

VENOM defeats traditional defenses by combining:

• MFA bypass (AiTM + device‑code flow)
• Session token theft
• Real‑time Microsoft authentication relay
• Highly personalized social engineering
• Stealth filtering to avoid detection

Researchers emphasize that MFA alone is no longer sufficient against these attacks.

Recommended Defenses

Security researchers and Microsoft recommend:

• FIDO2 / phishing‑resistant authentication
• Disable unused device‑code flows
• Stricter Conditional Access policies
• Blocking legacy authentication
• Enhanced QR‑code phishing detection