Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks

Threat actors are abusing HTTP client tools such as Axios alongside Microsoft 365 Direct Send to run highly efficient phishing campaigns, ReliaQuest has found. Axios activity surged 241% from June to August 2025, with Axios accounting for 24.44% of activity across 32 flagged user agents observed in that period. Proofpoint previously flagged Axios abuse in January 2025 for account takeover attempts in Microsoft 365 environments, according to The Hacker News.

The campaigns also leverage Salty 2FA, a nascent phishing‑as‑a‑service kit that targets Microsoft login credentials and MFA, using Multi‑Factor Authentication simulations across six methods and staging pages on platforms like Aha[.]io, before presenting credential harvesting pages. Attacks have achieved a reported 70% success rate when paired with Direct Send, bypassing secure gateways and delivering malicious content to inboxes.

The observed campaign began in July 2025, initially targeting executives and managers in finance, health care and manufacturing before expanding to all users.