New Phishing Platform Used in Credential Theft Campaigns Against C-Suite Execs

Abnormal researchers uncovered a credential‑harvesting campaign (Nov 2025–Mar 2026) targeting C‑suite and senior executives using a closed‑access phishing‑as‑a‑service named Venom. The platform delivered SharePoint‑themed QR‑code lures and used extensive personalization, randomized HTML, fabricated email threads, and human‑verification checks to evade detection; it then bypassed or neutralized MFA via adversary‑in‑the‑middle and device‑code flows to obtain persistent access, and its licensing/management features indicate potential for wider proliferation.