VENOM phishing platform targets executives’ Microsoft credentials
Summary
Researchers say VENOM targets senior executives with personalized SharePoint lures, Unicode QR codes and filtered phishing pages that use AiTM or device-code flows to capture Microsoft credentials, MFA codes and session tokens.
Key points
- Researchers at Abnormal report that VENOM, a previously undocumented, apparently closed-access phishing service, has targeted CEOs, CFOs and VPs across industries since at least last November.
- Personalized emails impersonate Microsoft SharePoint notifications and use fake email threads to appear credible.
- Unicode-rendered QR codes direct targets to mobile phishing pages; double Base64-encoded email addresses in URL fragments conceal targets from server-side logs and reputation feeds.
- Landing pages filter out researchers and sandboxed environments, redirecting other visitors to legitimate websites.
- The phishing platform proxies Microsoft logins in real time to capture credentials, MFA codes and session tokens; researchers also observed device-code phishing.
- Researchers say the operation establishes persistent account access by registering a device in AiTM flows or obtaining a token through device-code flows.
- Recommended defenses include FIDO2 authentication, disabling device-code flows when unnecessary and enforcing stricter conditional-access policies.
Article Details
- Attack Vectors
- Personalized phishing emails impersonate Microsoft SharePoint document-sharing notifications and include fabricated email threads.
- Emails contain Unicode-rendered QR codes that direct targets to phishing landing pages.
- The target's email address is double Base64-encoded in the URL fragment.
- Landing pages filter out researchers and sandboxed environments before directing intended targets to credential-harvesting pages.
- VENOM proxies Microsoft login flows in real time to capture credentials, MFA codes, and session tokens.
- Device-code phishing tricks victims into approving access to their Microsoft accounts for a rogue device.
- Defensive Notes
- Use FIDO2 authentication.
- Disable device-code flow when it is not needed.
- Implement stricter conditional access policies to block token abuse.
- The researchers note that MFA alone is no longer sufficient.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationVENOM double Base64-encodes the target’s email address in the URL fragment.T1036 · MasqueradingThe emails masquerade as Microsoft SharePoint document-sharing notifications and include fabricated, target-specific email threads.T1056.003 · Web Portal CaptureCredential-harvesting pages proxy Microsoft login flows and capture credentials and MFA codes.T1098.005 · Device RegistrationDuring the AiTM flow, VENOM registers a new device on the victim’s account.T1204.001 · Malicious LinkVictims scan the QR code in the phishing email to reach the attacker’s landing page.T1497 · Virtualization/Sandbox EvasionLanding pages filter out security researchers and sandboxed environments before redirecting intended targets.T1528 · Steal Application Access TokenIn the device-code phishing flow, VENOM obtains a token after tricking the victim into approving access to their Microsoft account.T1557 · Adversary-in-the-MiddleVENOM uses an adversary-in-the-middle flow to relay Microsoft login activity and capture authentication data.T1566.002 · Spearphishing LinkPhishing emails direct executives to credential-harvesting pages through Unicode QR codes.