VoidProxy PhaaS Targets Microsoft 365 and Google Accounts in New Campaign

VoidProxy, a phishing-as-a-service (PhaaS) operation, has emerged targeting Microsoft 365 and Google accounts, according to Okta. The campaign is described as using advanced adversary-in-the-middle techniques to bypass multi-factor authentication and steal session tokens during sign-in, with a four-stage attack flow that begins with compromised legitimate email services and culminates in the interception of authentication tokens.

The platform evades detection through multiple layers, including the use of CAPTCHA challenges and Cloudflare Workers, and relies on redirects and disposable domains to host phishing pages that imitate legitimate login portals for Microsoft 365 and Google.

It also redirects federated users to second-stage pages and can integrate with third-party single sign-on providers like Okta to reach secondary phishing pages, aided by an admin interface for campaign management and data extraction methods such as real-time Telegram notifications. The piece notes that to defend against VoidProxy, organisations should adopt phishing-resistant authenticators like Okta FastPass, FIDO2 WebAuthn, and implement layered controls, user education, and automated real-time remediation. September 15, 2025.