Unveiling VoidProxy: The Phishing-as-a-Service That Bypasses MFA

According to Okta Threat Intelligence, VoidProxy is a previously unreported Phishing-as-a-Service platform that represents a serious threat to cloud identity security, capable of capturing credentials, MFA codes and session tokens in real time via Adversary-in-the-Middle techniques. The analysis notes that VoidProxy targets Microsoft and Google accounts and can redirect accounts protected by third‑party SSO providers like Okta to second‑stage phishing pages.

It also highlights that the service uses compromised email accounts, multiple redirects, Cloudflare CAPTCHA challenges, Cloudflare Workers and dynamic DNS services to evade detection, with phishing campaigns beginning from compromised ESP accounts and obfuscated links that land victims on disposable phishing domains. Okta’s research details a four‑stage attack chain: delivery and lure, evasion and lure loading, second‑stage pages, and an AitM relay with session hijacking.

While VoidProxy can bypass common MFA protections, phishing‑resistant authenticators such as Okta FastPass were shown to block attempts, with users enrolled in such authenticators warned their account was under attack. The post was published on 12 September 2025.