void-proxy

VoidProxy: AitM Phishing-as-a-Service Quietly Bypasses MFA at Scale

VoidProxy is reshaping the phishing landscape, enabling adversaries to bypass MFA and hijack enterprise cloud sessions with minimal technical skill. Its rapid adoption, use of trusted email providers, and evasive infrastructure demand urgent, layered defenses—especially for organizations...

Wes

Wes

— 13 min read
Share
VoidProxy: AitM Phishing-as-a-Service Quietly Bypasses MFA at Scale
OTP accepted. Passkeys walk by.

TL;DR

Key Points

  • Enforce phishing-resistant authentication (FIDO2, Okta FastPass) to block AitM attacks.
  • Integrate VoidProxy IOCs and domain patterns into email/web gateways for early detection.
  • Monitor for session hijacking and anomalous access; automate session revocation.
  • Harden controls on ESP abuse and educate users on multi-stage phishing lures.
  • Prioritize rapid detection and response to BEC and credential theft incidents.

The story in 60 seconds

VoidProxy is a Phishing-as-a-Service platform enabling adversary-in-the-middle (AitM) attacks that bypass MFA and hijack sessions for Microsoft 365, Google Workspace, and SSO environments. It leverages compromised accounts at trusted email service providers, disposable TLDs, dynamic DNS, and Cloudflare Workers to evade detection and takedown. The platform’s admin panel allows even low-skilled actors to launch advanced phishing campaigns, resulting in credential theft, session hijacking, and business email compromise (BEC) across enterprise, finance, healthcare, education, and government sectors.

VoidProxy’s technical sophistication—real-time proxying, session token theft, and anti-analysis—makes legacy MFA (SMS, OTP) ineffective. Its rapid adoption is driving a surge in BEC and persistent account takeovers, especially in organizations slow to adopt phishing-resistant authentication. No nation-state links are confirmed, but eCrime actors are leveraging VoidProxy at scale.

Defenders must act quickly: enforce phishing-resistant authentication, integrate threat intelligence, harden email/web gateways, and train users to recognize evolving lures. Okta’s data shows that organizations using FIDO2/WebAuthn were not compromised by VoidProxy.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Why it matters

SOC

  • Monitor for logins from new locations/devices, especially after phishing alerts.
  • Flag emails from compromised ESPs (Constant Contact, Active Campaign, NotifyVisitors).
  • Alert on access to sensitive apps from unmanaged or rarely used networks.

IR

  • Preserve session tokens, authentication logs, and email headers for suspected AitM events.
  • Triage incidents involving disposable TLDs (.icu, .sbs, .xyz, etc.) and dynamic DNS domains.
  • Investigate BEC and lateral movement following credential compromise.

SecOps

  • Mandate phishing-resistant authenticators; phase out legacy MFA.
  • Restrict sensitive app access to managed devices; enforce IP session binding.
  • Integrate threat intel feeds (VoidProxy IOCs) into security controls.

Strategic

  • Accelerate adoption of phishing-resistant authentication org-wide.
  • Review and update incident response playbooks for AitM and session hijacking.
  • Engage with ESPs and industry partners to improve detection and takedown.

See it in your telemetry

Network

  • Detect outbound connections to disposable TLDs (.icu, .sbs, .xyz, .top, .home) and dynamic DNS (sslip[.]io, nip[.]io).
  • Monitor for multi-stage redirects and URL shorteners in inbound email links.
  • Flag traffic to Cloudflare Workers serving as phishing gatekeepers.

Endpoint

  • Alert on browser session token exfiltration or anomalous cookie access.
  • Monitor for new device registrations or logins from unmanaged endpoints.
  • Detect credential input on suspicious SSO or cloud login pages.

High Impact, Quick Wins

  • Enforce phishing-resistant authentication for all users; measure enrollment and coverage.
  • Integrate VoidProxy IOCs and domain patterns into email/web security; track detection rates.
  • Launch targeted phishing simulations mimicking VoidProxy TTPs; monitor user reporting and click rates.

Research

Historical Context

VoidProxy is a Phishing-as-a-Service (PhaaS) platform first publicly analyzed by Okta Threat Intelligence in September 2025. It represents a significant evolution in the PhaaS ecosystem, enabling a broad range of threat actors to conduct advanced adversary-in-the-middle (AitM) phishing campaigns. The platform is notable for its ability to bypass modern authentication controls, including multi-factor authentication (MFA), and for its rapid adoption in eCrime campaigns targeting enterprise cloud authentication systems, especially Microsoft 365, Google accounts, and federated SSO environments.

Timeline

  • September 2025: Okta Threat Intelligence publishes the first comprehensive technical analysis of VoidProxy, detailing its infrastructure, TTPs, and campaign patterns.
  • September 2025: CSO Online corroborates Okta’s findings and highlights the operational impact of VoidProxy in active phishing campaigns.
  • September 2025: Dark web monitoring firms and industry roundups note increased chatter about VoidProxy in cybercrime forums.

Origin

VoidProxy’s origin is attributed to the cybercriminal underground, with no direct ties to a specific nation-state APT group. Its design and operational model are consistent with eCrime PhaaS offerings, lowering the technical barrier for a wide range of actors. No credible primary source has reported language artifacts or nation-state attribution; all such claims should be considered speculative unless directly cited.

Countries Targeted

  1. United States – Primary target due to the prevalence of Microsoft 365 and Google Workspace in US enterprises.
  2. United Kingdom – High adoption of targeted cloud services and SSO providers.
  3. European Union countries – Similar enterprise cloud adoption and regulatory impact.
  4. Canada – Noted in Okta’s research as a region with significant enterprise targeting.
  5. Australia – Observed in global phishing campaigns leveraging VoidProxy.

Sectors Targeted

  1. Enterprise/Corporate (Microsoft 365, Google Workspace users) – Main focus due to the value of business email compromise and lateral movement.
  2. Financial Services – Targeted for fraud and data exfiltration.
  3. Healthcare – Sought for sensitive data and insurance fraud.
  4. Education – Targeted for credential harvesting and access to research data.
  5. Government – Targeted for access to sensitive communications and data.

Motivation

VoidProxy is financially motivated, designed to facilitate credential theft, session hijacking, BEC, financial fraud, and data exfiltration. Its PhaaS model enables both sophisticated and low-skilled actors to launch advanced phishing campaigns for profit.

Attack Types

  • Adversary-in-the-Middle (AitM) Phishing: Real-time interception of credentials, MFA codes, and session tokens.
  • Session Hijacking: Theft and reuse of valid session cookies for account takeover.
  • Business Email Compromise (BEC): Post-compromise fraud and lateral movement.
  • Credential Harvesting: Targeting enterprise and federated SSO accounts.
  • Infrastructure Evasion: Use of Cloudflare Workers, dynamic DNS, and disposable domains to evade detection and takedown.

Similar Threat Actor Groups

VoidProxy’s operational model and TTPs are similar to other PhaaS platforms such as EvilProxy and Caffeine, which also enable AitM phishing and session hijacking at scale.

Technical Infrastructure and TTPs

  • Delivery: Phishing lures are sent from compromised accounts of legitimate Email Service Providers (ESPs) such as Constant Contact, Active Campaign, and NotifyVisitors, leveraging their reputation to bypass spam filters.
  • Redirection: Embedded phishing links use URL shortening services (e[.]g., TinyURL) and multiple redirects to evade automated analysis.
  • Landing Pages: First-stage phishing pages are hosted on low-cost, disposable TLDs (.icu, .sbs, .cfd, .xyz, .top, .home), placed behind Cloudflare to hide real IP addresses.
  • Cloudflare Workers: Used as gatekeepers and lure loaders, filtering traffic and loading phishing content only for legitimate targets.
  • Dynamic DNS: Core infrastructure is hosted on dynamic DNS wildcard services (sslip[.]io, nip[.]io), resolving hostnames with embedded IP addresses.
  • AitM Proxy Engine: Relays authentication flows, captures credentials, MFA codes, and session tokens, and exfiltrates valid session cookies to attacker admin panels.
  • Admin Panel: Full-featured interface for campaign management, victim monitoring, and data extraction (manual download, Telegram bots, webhook alerts).
  • Anti-Analysis: Automated scanners are redirected to benign welcome pages, and Cloudflare CAPTCHA challenges are used to filter bots.

Recommendations, Actions, Suggested Pivots, Forecasts, Next Steps and References..

(Specially baked, for Paid Subscribers..)

Recommendations, Actions and Next Steps

VoidProxy represents a significant escalation in the phishing-as-a-service (PhaaS) landscape, enabling adversary-in-the-middle (AitM) attacks that bypass traditional MFA and target enterprise cloud authentication at scale. Its rapid adoption, technical sophistication, and ability to evade detection demand urgent, multi-layered defensive action.

  1. Enforce Phishing-Resistant Authentication and Session Controls

    • Actions:
      • Mandate enrollment in phishing-resistant authenticators (FIDO2 WebAuthn, Okta FastPass, smart cards) for all users, prioritizing those with access to sensitive or administrative resources.
      • Update authentication policies to require these methods and phase out legacy MFA (SMS, OTP apps) that are vulnerable to AitM attacks.
      • Apply IP session binding and require re-authentication for sensitive actions and all administrative functions.
      • Restrict access to sensitive applications to managed and protected devices; require higher assurance for requests from rarely used networks.
    • Expected Impact: Directly blocks VoidProxy’s ability to intercept credentials and session tokens, reducing the risk of account takeover and lateral movement.
    • Potential Challenges:
      • User/device compatibility and resistance to new authentication methods.
      • Integration with legacy systems and phased rollout logistics.
    • Metrics for Success:
      • Percentage of users enrolled in phishing-resistant authentication.
      • Reduction in successful phishing-related account takeovers.
      • Number of session hijacking attempts detected and blocked.
    • MITRE ATT&CK IDs: T1556[.]003, T1550[.]004, T1110[.]002

  2. Harden Email and Web Gateway Controls with Targeted Threat Intelligence

    • Actions:
      • Integrate threat intelligence feeds (e[.]g., Okta’s VoidProxy IOCs) into email and web security platforms such as Proofpoint, Microsoft Defender for Office 365, or Google Workspace Security.
      • Prioritize detection and blocking of:
        • Domain patterns (e[.]g., .icu, .sbs, .cfd, .xyz, .top, .home)
        • Dynamic DNS (sslip[.]io, nip[.]io)
        • IPs and behavioral indicators associated with VoidProxy infrastructure
        • URL shorteners and multi-stage redirects
      • Tune detection rules to flag emails from compromised ESPs (Constant Contact, Active Campaign, NotifyVisitors) and monitor for anomalous sending patterns.
      • Deploy advanced URL detonation and sandboxing to analyze links before delivery to end users.
    • Expected Impact: Disrupts VoidProxy’s primary delivery and evasion mechanisms, reducing user exposure to malicious lures and landing pages.
    • Potential Challenges:
      • False positives affecting legitimate business communications.
      • Continuous tuning and resource requirements for threat intelligence integration.
    • Metrics for Success:
      • Number of phishing emails detected and blocked.
      • Reduction in user click-through rates on malicious links.
      • Frequency of successful phishing attempts.
    • MITRE ATT&CK IDs: T1566[.]001, T1566[.]002, T1204[.]001

  3. Deploy Continuous User Awareness, Behavioral Analytics, and Automated Remediation

    • Actions:
      • Launch targeted security awareness campaigns and simulated phishing exercises that mimic VoidProxy’s TTPs (multi-stage redirects, Cloudflare CAPTCHA, fake SSO pages).
      • Implement behavioral analytics (e[.]g., Okta Behavior and Risk evaluations) to detect anomalous access requests, such as logins from new locations, rapid session changes, or unmanaged devices.
      • Automate remediation flows: session revocation, forced re-authentication, and real-time alerts for suspicious activity.
      • Enable users to report suspicious emails and activity via integrated notification and reporting tools.
    • Expected Impact: Increases user vigilance, reduces susceptibility to advanced phishing, and enables rapid detection and response to compromised accounts.
    • Potential Challenges:
      • Training fatigue and balancing user privacy with monitoring.
      • Ensuring analytics are tuned to minimize false positives.
    • Metrics for Success:
      • User-reported phishing incidents.
      • Participation rates in training and simulations.
      • Number of anomalous access events detected and remediated.
    • MITRE ATT&CK IDs: T1087[.]002, T1078[.]004, T1110[.]003

Suggested Pivots

  1. How do specific infrastructure components used by VoidProxy—such as Cloudflare Workers, dynamic DNS wildcard services (sslip[.]io, nip[.]io), and disposable low-cost TLDs (.icu, .sbs, .cfd, .xyz, .top, .home)—contribute to its evasion capabilities, and what detection or disruption techniques can be developed to target these elements effectively?

  2. What empirical evidence exists regarding the real-world effectiveness and bypass rates of phishing-resistant authentication methods (e[.]g., Okta FastPass, FIDO2 WebAuthn, smart cards) against advanced AitM phishing platforms like VoidProxy, particularly in federated SSO environments, and what improvements or alternative approaches are needed?

  3. To what extent does the compromise and abuse of legitimate Email Service Providers (such as Constant Contact, Active Campaign, NotifyVisitors) facilitate VoidProxy’s phishing lure delivery, and what monitoring, detection, and mitigation strategies can organizations implement to identify and prevent such trusted sender exploitation?

Forecast

Short-Term Forecast (3-6 months)

  • Sector-Specific Targeting Intensifies: VoidProxy campaigns will disproportionately impact the financial services, healthcare, and education sectors in the United States, United Kingdom, and European Union. These sectors are targeted due to the high value of credentials and sensitive data, as well as regulatory pressures that may expose vulnerabilities in cloud authentication systems.
  • Increased Use of Compromised ESPs for Phishing Delivery: Attackers will escalate the abuse of legitimate Email Service Providers (Constant Contact, Active Campaign, NotifyVisitors) to send phishing lures, leveraging their trusted reputation to bypass spam filters and increase user click-through rates.
  • Escalation of Session Hijacking and BEC Incidents: The real-time interception of session tokens by VoidProxy will lead to a rise in persistent account takeovers and business email compromise (BEC) fraud, especially in enterprises with legacy MFA methods (SMS, OTP apps) still in use.
  • Rapid Adoption of Phishing-Resistant Authentication: Organizations with mature security postures will accelerate deployment of phishing-resistant authenticators (FIDO2 WebAuthn, Okta FastPass, smart cards), significantly reducing their exposure to VoidProxy attacks. Okta’s data shows users enrolled in these methods were not compromised by VoidProxy.
  • Threat Intelligence Integration and Detection Improvements: Security teams will prioritize integrating VoidProxy IOCs (disposable TLDs, dynamic DNS domains, Cloudflare Workers) into email and web gateways, improving detection and blocking of phishing infrastructure. However, false positives and operational tuning will remain challenges.
  • User Awareness and Behavioral Analytics: Targeted phishing simulations mimicking VoidProxy’s multi-stage redirects and CAPTCHA challenges will be deployed to improve user vigilance. Behavioral analytics will increasingly detect anomalous access patterns (e[.]g., logins from new locations or devices), triggering automated remediation such as session revocation and forced re-authentication.

Examples

  • Okta’s analysis confirms that users enrolled in phishing-resistant authenticators like Okta FastPass were protected from VoidProxy’s AitM attacks.
  • CSO Online reports highlight the use of compromised ESPs to deliver phishing emails that evade spam filters, increasing campaign success.
  • Historical campaigns by EvilProxy and Caffeine demonstrate how disposable TLDs and dynamic DNS services enable rapid infrastructure turnover and evasion.
  • Studies show legacy MFA methods (SMS, OTP apps) are vulnerable to real-time interception, leading to increased account takeovers.

What to Watch Out For

  • Spike in phishing emails originating from compromised ESP accounts targeting financial, healthcare, and education sectors.
  • Increased detection of session hijacking attempts and BEC incidents linked to VoidProxy infrastructure.
  • Adoption metrics of phishing-resistant authentication methods within enterprises.
  • Integration status and tuning effectiveness of VoidProxy IOCs in email and web security platforms.
  • User-reported phishing incidents and participation rates in targeted awareness campaigns.

Long-Term Forecast (12-24 months)

  • Evolution and Sophistication of VoidProxy: VoidProxy will evolve to incorporate AI-driven dynamic content generation and enhanced anti-analysis techniques, such as polymorphic phishing pages and adaptive CAPTCHA challenges, making detection and takedown more difficult.
  • Expansion to Additional Cloud and SSO Platforms: The platform will broaden its targeting beyond Microsoft 365 and Google Workspace to include other popular cloud services and federated SSO providers, increasing its global attack surface.
  • Adoption by More Sophisticated Threat Actors: While currently an eCrime PhaaS, there is a plausible risk that more sophisticated threat actors, including nation-state affiliated groups, may repurpose or adapt VoidProxy’s technology for espionage or disruption campaigns, given its ability to bypass MFA and access sensitive communications.
  • Regulatory and Compliance Pressure: Governments and regulatory bodies will increasingly mandate phishing-resistant authentication and stricter access controls in critical sectors (finance, healthcare, government), driven by the demonstrated risks of platforms like VoidProxy.
  • Advances in AI-Based Detection and Behavioral Analytics: Security vendors will develop AI-powered detection systems specifically tuned to identify AitM phishing patterns, session hijacking anomalies, and infrastructure evasion tactics at scale, improving early warning and automated response capabilities.
  • Tighter Security Controls on ESPs: Email Service Providers will implement stronger security monitoring and anomaly detection to prevent account compromise and abuse, potentially reducing VoidProxy’s ability to leverage these trusted channels.
  • Increased Industry Collaboration: Enhanced information sharing and coordinated defense initiatives involving threat intelligence communities, cloud providers, and law enforcement will improve detection, takedown, and disruption of VoidProxy infrastructure and campaigns.

Examples

  • EvilProxy’s evolution from a simple phishing tool to a multi-vector attack platform in 2024-2025 illustrates the likely trajectory of VoidProxy’s sophistication.
  • Regulatory mandates such as those emerging in the EU and US for phishing-resistant MFA in financial services and healthcare sectors provide a precedent for future compliance-driven security improvements.
  • AI-driven phishing detection tools have shown promise in identifying sophisticated campaigns that evade traditional defenses.
  • Past efforts to secure ESPs have led to improved sender reputation management and anomaly detection, reducing their exploitation by attackers.

What to Watch Out For

  • Emergence of VoidProxy variants employing AI-generated phishing content or advanced evasion techniques.
  • Campaigns targeting new cloud platforms or SSO providers beyond Microsoft and Google.
  • Regulatory announcements mandating phishing-resistant authentication and session security in critical sectors.
  • Deployment and effectiveness of AI-based phishing detection and behavioral analytics tools.
  • Changes in ESP security policies and monitoring that reduce account compromise rates.
  • Public-private partnerships and threat intelligence sharing initiatives focused on VoidProxy.

MITRE ATT&CK IDs

T1557, T1566[.]002, T1185, T1556[.]003, T1550[.]004, T1110[.]002, T1087[.]002, T1078[.]004, T1110[.]003, TA0001, TA0006, TA0003

Appendix

References

  1. (2025-09-11) - Uncloaking VoidProxy: a Novel and Evasive Phishing-as-a-Service Framework | Okta Security
  2. (2025-09-12) - VoidProxy phishing-as-a-service operation steals Microsoft, Google login credentials | CSO Online
  3. (2025-09-17) - September 17th – This Week's Top Cybersecurity and Dark Web Stories | Searchlight Cyber

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

(c) 2025 CSIRT Gadgets, LLC

MITRE ATTACK

Techniques

  1. [T1557] Adversary-in-the-Middle – VoidProxy’s core capability is real-time adversary-in-the-middle (AitM) phishing, which proxies authentication flows to intercept credentials, MFA codes, and session tokens. Okta’s technical analysis describes how VoidProxy relays authentication between the victim and legitimate cloud services, capturing all authentication artifacts for account takeover. This is the primary mechanism by which VoidProxy bypasses MFA and hijacks sessions.

  2. [T1566.002] Phishing: Spearphishing Link – VoidProxy campaigns deliver phishing lures via links embedded in emails sent from compromised ESPs (e.g., Constant Contact, Active Campaign). These links use multiple redirects, URL shorteners, and disposable TLDs to evade detection, as detailed in Okta’s and CSO Online’s reporting.

  3. [T1185] Browser Session Hijacking – VoidProxy’s proxy engine captures and exfiltrates valid session cookies, enabling attackers to hijack authenticated sessions and bypass authentication controls. Okta’s technical writeup describes the theft and reuse of session tokens for account takeover and lateral movement.

Tactics

  1. [TA0001] Initial Access – VoidProxy campaigns begin with phishing emails to gain a foothold in target environments, as described in both Okta and CSO Online reporting.

  2. [TA0006] Credential Access – The primary goal of VoidProxy is to capture credentials, MFA codes, and session tokens, as detailed in Okta’s technical analysis.

  3. [TA0003] Persistence – By hijacking session tokens, VoidProxy enables persistent access to victim accounts even after password changes, as described in Okta’s reporting.

Procedures

  1. [T1557] Real-time AitM proxying: VoidProxy relays authentication flows between the victim and legitimate cloud services, capturing credentials, MFA codes, and session tokens. This is described in Okta’s technical analysis and corroborated by CSO Online.

  2. [T1566.002] Use of compromised ESPs and multi-stage redirects: VoidProxy leverages compromised accounts at legitimate ESPs to send phishing lures, using URL shorteners and disposable TLDs to evade detection, as detailed in Okta’s and CSO Online’s reporting.

  3. [T1185] Exfiltration and reuse of session cookies: The platform’s admin panel allows attackers to download session tokens and use them for account takeover, as described in Okta’s technical writeup.

Software

  1. [S1046] EvilProxy – EvilProxy is a similar PhaaS platform enabling AitM phishing and session hijacking, referenced for comparative analysis in Okta’s reporting. VoidProxy itself is not yet cataloged in MITRE as of September 2025.

Mitigations

  1. [M1032] Multi-factor Authentication – VoidProxy is designed to bypass legacy MFA (SMS, OTP apps) by intercepting codes in real time. Okta and CSO Online recommend enforcing phishing-resistant authenticators (FIDO2, Okta FastPass, smart cards) to block AitM attacks.

  2. [M1026] Privileged Account Management – Restricting access to sensitive applications and enforcing session controls (e.g., IP session binding, forced re-authentication) is recommended by Okta to limit the impact of session hijacking.

  3. [M1017] User Training – Okta and CSO Online recommend continuous user awareness and simulated phishing to reduce susceptibility to advanced phishing lures.

Groups

  1. [G1046] Storm-1811 (EvilProxy) – Storm-1811 is known for distributing malicious links to EvilProxy-based phishing sites, which share operational similarities with VoidProxy. VoidProxy itself is not yet cataloged in MITRE as of September 2025.

Read more