Cybersecurity researchers at Okta have uncovered a sophisticated new phishing-as-a-service (PhaaS) platform called VoidProxy that specifically targets Microsoft 365 and Google accounts, including those protected by third-party single sign-on (SSO) providers like Okta.

## How VoidProxy Works

VoidProxy employs adversary-in-the-middle (AitM) tactics to steal user credentials, multi-factor authentication (MFA) codes, and session cookies in real time. The platform is described as highly scalable, evasive, and sophisticated in its approach.

### The Attack Process

**Initial Contact**: Attacks begin with phishing emails sent from compromised accounts at legitimate email service providers, including Constant Contact, Active Campaign, and NotifyVisitors. These emails contain shortened links that redirect victims through multiple redirections to malicious phishing sites.

**Infrastructure**: The malicious sites are hosted on disposable, low-cost domains using extensions like .icu, .sbs, .cfd, .xyz, .top, and .home. These sites are protected by Cloudflare to hide their real IP addresses and add legitimacy.

**Filtering System**: Visitors first encounter a Cloudflare CAPTCHA challenge designed to filter out bots and increase the appearance of legitimacy. A Cloudflare Worker environment is used to filter traffic and load pages selectively.

**Targeted Phishing**: Selected targets receive pages that perfectly mimic Microsoft or Google login screens, while other visitors are redirected to generic “Welcome” pages that pose no threat.

### The Credential Theft Process

When victims enter their credentials into the phishing forms, VoidProxy’s AitM system proxies these requests to legitimate Google or Microsoft servers. For federated accounts using SSO providers like Okta, victims are redirected to second-stage phishing pages that impersonate Microsoft 365 or Google SSO flows.

The platform’s proxy server acts as an invisible middleman, relaying traffic between victims and legitimate services while capturing usernames, passwords, and MFA codes. When legitimate services issue session cookies, VoidProxy intercepts and copies them, making them immediately available to attackers through the platform’s admin panel.

## Protection and Recommendations

Notably, users enrolled in phishing-resistant authentication methods like Okta FastPass were protected from VoidProxy attacks and received warnings about potential account compromise.

### Security Recommendations

Okta researchers recommend several protective measures:

– **Restrict sensitive app access** to managed devices only
– **Implement risk-based access controls**
– **Use IP session binding** for administrative applications
– **Enforce re-authentication** for administrators attempting sensitive actions

## Key Takeaway

VoidProxy represents a significant evolution in phishing attacks, demonstrating how cybercriminals are developing increasingly sophisticated tools to bypass traditional security measures. Organizations must adopt comprehensive, multi-layered security approaches that include phishing-resistant authentication methods to protect against these advanced threats.