A new phishing-as-a-service (PhaaS) platform dubbed “VENOM” is being used by malicious actors to steal credentials from high-level executives (like CEOs) in various sectors.

This campaign has been ongoing since at least November of last year and focuses on top-level employees such as CEOs, CFOs, and VPs.

VENOM appears to be invite-only, as no advertisements for it have been found publicly or in hacker communities, which makes it harder for security researchers to find.

Cybersecurity researchers at Abnormal discovered that the phishing emails are made to look like Microsoft SharePoint document sharing notifications to seem like internal correspondence.

The emails are specifically tailored to each recipient and include random HTML elements, for example, fake CSS classes. To further build trust, the attackers also include fabricated email chains relevant to the target.

A QR code is displayed using Unicode characters, which the victim is encouraged to scan. This tactic aims to bypass security scanners and redirect the attack to mobile devices.

“The targeted email address is encoded using double Base64 in the URL fragment — the part after the # character,” Abnormal’s researchers stated.

“Fragments aren’t sent in HTTP requests, keeping the target’s email address hidden from server logs and URL reputation tools.”

If the victim scans the QR code, they’re sent to a landing page that screens out security researchers and sandboxes, ensuring that only valid targets are redirected to the core phishing platform. Those who are not targets are redirected to real sites so as to not raise suspicion.

Targets who pass the checks are redirected to a credential-harvesting site that imitates a real-time Microsoft login process, forwarding credentials and MFA codes to Microsoft APIs and capturing the session token.

Besides the adversary-in-the-middle (AiTM) approach, Abnormal has also observed a device-code phishing technique where the victim is tricked into granting access to their Microsoft account to a malicious device.

This method has become increasingly popular in the last year because of its effectiveness and resilience to password resets, with numerous phishing kits now offering it.

In both attack types, VENOM quickly gains persistent access during the authentication phase. In the AiTM method, it registers a new device to the victim’s account. In the device code method, it grabs a token that grants access to the account.

The researchers emphasize that multi-factor authentication is not enough to protect against these attacks. High-level executives should use FIDO2 authentication, turn off device code flow when it’s not needed, and prevent token abuse by employing stricter conditional access policies.