A newly uncovered phishing-as-a-service (PhaaS) platform dubbed “VENOM” has been actively targeting the Microsoft credentials of C-suite executives across multiple industries since at least November 2025, researchers at cybersecurity firm Abnormal have revealed.
Unlike many cybercriminal toolkits that are openly advertised on underground forums, VENOM appears to operate as a closed-access platform, limiting its exposure to security researchers while signaling a high degree of operational intentionality. The campaign focuses specifically on individuals holding titles such as CEO, CFO, and Vice President at their organizations.
Built to Evade Detection at Every Stage
The attack begins with a phishing email impersonating a Microsoft SharePoint document-sharing notification, designed to appear as routine internal communication. Each email is highly personalized, incorporating the target’s name, company branding, and a sender address dynamically generated from the target’s own domain.
To further confound automated detection systems, every email is seeded with random HTML noise including throwaway CSS classes and fake comments, and contains a fabricated five-message email conversation thread to lend credibility to the lure.
Rather than embedding a traditional hyperlink, VENOM delivers a QR code constructed entirely from Unicode block characters rendered inside an HTML pre-tag, a technique that defeats standard image-scanning tools and shifts the interaction to a mobile device, outside the corporate security perimeter.
The target’s email address is double Base64-encoded in the URL fragment (the portion following the # character), a deliberate design choice since URL fragments are never transmitted in HTTP requests, rendering the encoded data invisible to server-side logs and URL reputation feeds.
A Filtering Gate That Weeds Out Researchers
When a target scans the QR code, they first arrive at a gating page that acts as a multi-stage filter. The gate runs client-side User-Agent checks against a blocklist of nearly 400 known security tools and bots, performs IP reputation lookups, and employs honeypot interactions to fingerprint automated scanners.
Visitors flagged at any stage are silently redirected to legitimate websites to avoid suspicion, ensuring that only genuine targets reach the credential-harvesting infrastructure.
Two Paths to Account Takeover
Targets who pass through the gate are delivered to one of two harvesting methods. In adversary-in-the-middle (AiTM) mode, VENOM proxies the victim’s real Microsoft login flow in real time, relaying credentials and MFA codes to Microsoft’s own APIs while simultaneously capturing the authenticated session token. Before the session ends, VENOM’s backend registers an attacker-controlled device on the victim’s account, establishing persistence that survives any subsequent password reset.
In the second method, device code phishing, victims never encounter a login form at all. Instead, the page presents as a DocuSign notification instructing the user to enter a code at the legitimate Microsoft device login portal. This grants the attacker a long-lived refresh token tied to the victim’s account.
Because the token itself serves as the persistence mechanism, even a forced password reset does not revoke access. Abnormal notes that device code phishing has surged in popularity over the past year, with at least 11 phishing kits now offering it as an option.
Both techniques are designed to defeat MFA outright, not bypass it. The campaign captures live authentication sessions rather than static credentials, rendering traditional second-factor protections ineffective.
MFA Alone Is No Longer Enough
Abnormal researchers characterize VENOM as one of the more technically complete phishing operations they have documented, noting that its sophistication lies not in any single technique but in the cohesion of the full pipeline, each stage actively protecting the next.
The discovery of VENOM as a PhaaS offering suggests that these advanced, multi-layered attack capabilities could be licensed out to additional threat actors, multiplying the potential threat to senior executives across industries.
Security experts recommend that organizations adopt FIDO2 hardware-based authentication for high-value accounts, disable the Microsoft device code authentication flow where it is not operationally necessary, and implement strict conditional access policies to limit token abuse. These mitigations are considered the most reliable defenses against AiTM and device code phishing techniques.
Sources: BleepingComputer | Abnormal
