Topic starter
27/06/2026 1:46 pm
TL;DR: VENOM is a closed phishing-as-a-service platform that combines SharePoint-themed lures, real-time session relay, Device Code abuse, and post-auth persistence to bypass MFA and retain access after password resets, according to Abnormal AI. The campaign shows that authentication controls can fail at the protocol boundary when session and token lifecycle governance is weak.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Meet VENOM: The PhaaS Platform That Neutralizes MFA”.
By the numbers:
- 60% of targeted recipients hold C-level, President, or Chairman titles across more than 20 verticals.
- The campaign targeted executives and senior officers over a five-month period from November 2025 through March 2026.
Key questions
Q: What breaks when MFA is used only at sign-in and not for privileged actions?
A: The main failure is stale trust.
Q: Why do admin password resets not always end an attacker session?
A: Password resets only reduce risk if refresh tokens and other session artefacts are revoked at the same time.
Q: What are the signs that MFA enrollment has been abused?
A: Unexpected device registrations, unusual factor-activation events, and authenticator changes that do not match user behaviour are strong indicators.
Practitioner guidance
- Audit post-authentication lifecycle controls Map which identity events remain active after password reset, including sessions, refresh tokens, and newly enrolled MFA devices.
- Require explicit session and token revocation Make active-session termination and token-grant revocation part of every compromise response for cloud identity platforms.
- Monitor MFA enrollment events as compromise signals Alert on unexpected device activation, factor addition, and other authenticator lifecycle changes, especially for executives and privileged staff.
Bottom line: VENOM shows that MFA can be bypassed without breaking the protocol when attackers relay live sessions or use Device Code approval to obtain valid trust artefacts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:13 pm
Login success is no longer the control boundary: This campaign shows that authentication completion can be a false endpoint when tokens, sessions, and registered factors outlive the sign-in event. MFA was satisfied, but the attacker still retained a durable identity foothold. The operational lesson is that identity governance has to extend past the credential check and into post-authentication state.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should teams respond when QR-code phishing reaches the identity provider?
A: Contain the account by revoking active sessions, invalidating token grants, and reviewing newly added MFA methods before restoring trust. The attack works because the victim’s browser can move on while the attacker’s issued access remains live.
👉 Read our full editorial: VENOM shows how MFA bypass now survives the login boundary