New VoidProxy phishing service targets Microsoft 365, Google accounts

A new phishing-as-a-service platform named VoidProxy has been uncovered, targeting Microsoft 365 and Google accounts, including those protected by third‑party SSO providers such as Okta. According to Okta Threat Intelligence, the adversary-in-the-middle techniques used by VoidProxy allow the theft of credentials, MFA codes, and session cookies in real time.

The campaign begins with emails from compromised accounts at email service providers like Constant Contact, Active Campaign, and NotifyVisitors, which link to phishing sites after multiple redirections. The malicious sites are hosted on disposable low-cost domains protected by Cloudflare, with a CAPTCHA step and a Cloudflare Worker to filter traffic before redirecting targets to login pages that mimic Microsoft or Google.

Federated accounts using Okta for SSO are redirected to a second-stage phishing flow that impersonates the respective SSO processes, with credentials and MFA codes proxied to Microsoft or Google servers. Okta noted that phishing‑resistant authentications such as Okta FastPass offered protection, and researchers recommended restricting access to sensitive apps, enforcing risk-based controls, and forcing re-authentication for admins.