VENOM shows how MFA bypass now survives the login boundary

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: VENOM, a closed phishing-as-a-service platform, bypasses MFA through session relay and Device Code abuse, then preserves access with device enrollment or refresh tokens.

Why it matters: It matters because IAM teams cannot treat MFA as the end of the control path when attackers can preserve access through tokens, session state, and post-authentication persistence.

By the numbers:

• 60% of targeted recipients hold C-level, President, or Chairman titles across more than 20 verticals.
• The campaign targeted executives and senior officers over a five-month period from November 2025 through March 2026.

Context

VENOM is a phishing campaign built to defeat the login boundary rather than break a protocol. The article describes a closed phishing-as-a-service platform that combines QR-code delivery, real-time session relay, Device Code abuse, and post-authentication persistence, which makes it an NHI and human IAM governance problem at the same time.

The governance gap is simple to name: authentication controls are often treated as the finish line, while session state, device registration, token revocation, and MFA lifecycle remain separate operational concerns. That separation fails when the attacker’s real objective is not password capture but durable access after the browser has already moved on.

The article also shows deliberate target selection, not spray-and-pray phishing. Senior executives across many industries were named in advance, which makes the campaign especially relevant to identity teams responsible for privileged human accounts and the controls that sit beyond initial sign-in.

Key questions

Q: What breaks when MFA is used only at sign-in and not for privileged actions?

A: The main failure is stale trust. A user may authenticate once and then remain authorized for hours or days, which is too broad for account deletion, payment approval, or access to secrets. Without re-authentication at the point of action, an attacker who inherits the session can complete high-risk operations without facing a fresh challenge.

Q: Why do admin password resets not always end an attacker session?

A: Password resets only reduce risk if refresh tokens and other session artefacts are revoked at the same time. If token state survives the reset, the attacker can stay authenticated even after the password changes, so identity recovery must include session invalidation and audit checks.

Q: What are the signs that MFA enrollment has been abused?

A: Unexpected device registrations, unusual factor-activation events, and authenticator changes that do not match user behaviour are strong indicators. In the campaign described here, the attacker could add a second MFA device without replacing the original one, which means the account still appears normal unless enrollment events are monitored.

Q: How should teams respond when QR-code phishing reaches the identity provider?

A: Contain the account by revoking active sessions, invalidating token grants, and reviewing newly added MFA methods before restoring trust. The attack works because the victim’s browser can move on while the attacker’s issued access remains live.

Technical breakdown

How VENOM turns QR-code phishing into session theft

VENOM uses QR codes to move the victim from email into a mobile browser flow that escapes many desktop-centric security checks. The lure is only the entry point. The real control break happens when the attacker relays the live session in real time, so the identity provider sees a valid interactive sign-in rather than a clear theft event. That is why adversary-in-the-middle phishing remains so effective: the attacker does not need to defeat MFA in the abstract, only to proxy the moment at which MFA is satisfied. The session produced by that interaction becomes the attacker’s asset.

Practical implication: review MFA assumptions against session relay rather than only against credential harvesting.

Why Device Code flow creates persistence after login

Device Code flow shifts the trust decision to a separate device-signin channel where the attacker can harvest access and refresh tokens after the user approves the code. Once the token exists, password reset alone does not invalidate the access path. The article’s point is not that Device Code is broken by design, but that token lifecycle and revocation become decisive. If the identity system does not explicitly revoke active sessions and token grants, the attacker can retain access through the same authentication system that granted it. That is a lifecycle problem, not just an authentication problem.

Practical implication: treat token revocation and session termination as part of the control path, not an optional cleanup step.

Why silent device registration changes the post-authentication boundary

In AiTM mode, VENOM registers a second MFA device during or immediately after the authenticated session, which the article says appears in logs as NO_DEVICE. That means the attacker is not replacing the user’s existing factor; they are adding a parallel factor that survives the original sign-in boundary. This is a post-authentication control failure because the organisation may believe MFA remains intact while the attacker has already expanded the account’s trust surface. Device registration, authenticator lifecycle, and account monitoring therefore sit inside the security boundary, not outside it.

Practical implication: monitor MFA enrollment events and treat unexpected device activation as an account-compromise signal.

NHI Mgmt Group analysis

Login success is no longer the control boundary: This campaign shows that authentication completion can be a false endpoint when tokens, sessions, and registered factors outlive the sign-in event. MFA was satisfied, but the attacker still retained a durable identity foothold. The operational lesson is that identity governance has to extend past the credential check and into post-authentication state.

Standing-authentication assumptions break under session relay: The assumption that a human sign-in is a discrete event that can be trusted once completed was designed for direct user interaction, not for live proxying through an attacker-controlled relay. That assumption fails when the attacker can satisfy MFA in real time and immediately reuse the resulting session. The implication is that identity programmes must stop treating interactive login as proof of continuing trust.

Token persistence is an access governance problem, not an incident footnote: Refresh tokens and active sessions create a governance surface that many remediation playbooks still underweight. When password reset does not revoke the attacker’s access, the real failure is lifecycle control over issued trust artefacts. Practitioners should recognise token revocation as a first-class identity control rather than a post-incident cleanup activity.

Silent factor enrollment creates a hidden second trust path: The article’s NO_DEVICE logging detail is the kind of signal that matters because it shows the attacker expanded account trust without displacing the original user factor. That is a governance blind spot for IAM and PAM teams alike: the account still appears legitimate while its factor set has changed underneath it. The implication is stronger monitoring of MFA enrollment state, not just sign-in success.

Ephemeral verification is not durable assurance: A QR code, a device-code approval, and a browser redirect can all look like normal authentication activity while still handing control to an attacker. Persistent authentication drift: is the right concept here, because the identity remains “authenticated” while the security relationship has already changed. Practitioners should treat any control that ends at authentication success as incomplete.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Persistent authentication drift: is the clearest programme-level lesson from this campaign. Security teams need to stop equating login success with durable trust, because session relay and token reuse can preserve access long after the original interaction ends.

Identity governance now has to include authenticator enrollment state, token revocation state, and session lifetime in the same operational view. If those controls are managed separately, an attacker can bypass MFA without finding a protocol flaw.

For organisations with executive accounts or cloud-connected identity providers, the practical shift is toward post-authentication monitoring. The question is no longer only who authenticated, but what trust artefacts were issued, modified, or left active afterward.

For practitioners

• Audit post-authentication lifecycle controls Map which identity events remain active after password reset, including sessions, refresh tokens, and newly enrolled MFA devices. The objective is to find where access survives the original authentication event.
• Require explicit session and token revocation Make active-session termination and token-grant revocation part of every compromise response for cloud identity platforms. Password reset alone does not break the access path described in the article.
• Monitor MFA enrollment events as compromise signals Alert on unexpected device activation, factor addition, and other authenticator lifecycle changes, especially for executives and privileged staff. The article shows these events can occur before a visible user warning appears.
• Harden phishing resistance beyond email filters Test controls against QR-based delivery, real-time session relay, and device-code abuse rather than only mailbox filtering. The attack chain succeeds because each stage is designed to hand off cleanly to the next.

Key takeaways

• VENOM shows that MFA can be bypassed without breaking the protocol when attackers relay live sessions or use Device Code approval to obtain valid trust artefacts.
• The campaign targets senior leaders across more than 20 verticals and is built for persistence, not one-off credential theft.
• The control that matters most is post-authentication governance over sessions, tokens, and MFA enrollment state, because password reset alone does not reliably end attacker access.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Device Code Flow: A device code flow is an OAuth pattern for clients that cannot host a browser. The application gets a user code and polling credential, while the user completes login in a separate browser session. In CLI contexts, it shifts risk into token handling and session boundary control.
• Post-Authentication Persistence: Post-authentication persistence is the set of actions an attacker takes after gaining a session to prevent easy recovery. In MFA fatigue incidents, that often means enrolling a new MFA method, changing passwords, or editing recovery settings before the victim can regain control.
• Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.