VoidProxy is a recently identified phishing-as-a-service (PhaaS) platform that targets Google and Microsoft 365 accounts, including those secured by third-party single sign-on (SSO) providers like Okta.
Real-time credentials, multi-factor authentication (MFA) codes, and session cookies are stolen by the platform using adversary-in-the-middle (AitM) techniques. Researchers from Okta Threat Intelligence found VoidProxy, which they characterize as clever, elusive, and scalable.
The attack starts with emails that contain shortened URLs that, after several redirections, take recipients to phishing websites. These emails come from hijacked accounts at email service providers such as Constant Contact, Active Campaign, and NotifyVisitors.
The malicious websites are housed on cheap, disposable domains ending in.icu,.sbs,.cfd,.xyz,.top, and.home that are shielded from their true IP addresses by Cloudflare read more about New VoidProxy phishing service targets Microsoft 365 Google accounts.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.