New VENOM phishing attacks steal senior executives' Microsoft logins

Threat actors operating a closed-access phishing-as-a-service platform called VENOM have been targeting C-suite Microsoft accounts since at least last November. Using highly personalized SharePoint-themed emails, Unicode QR codes that route victims to researcher-filtered landing pages, and either adversary-in-the-middle (AiTM) credential relaying or device-code approval flows, VENOM captures credentials, MFA codes, and session tokens; researchers warn these methods can bypass standard MFA and recommend FIDO2, disabling device-code flows when unnecessary, and stricter conditional access.