Microsoft disrupts ONNX phishing-as-a-service infrastructure

Microsoft seized 240 domains used by ONNX (aka Caffeine/FUHRER), a large phishing-as-a-service that sold subscription phishing kits with built-in 2FA bypass and QR-code "quishing" capabilities, which were responsible for tens to hundreds of millions of phishing emails targeting Microsoft 365 users and financial sector employees; the operation stopped after the operator's identity was disclosed and a court order redirected the infrastructure to Microsoft.