New VENOM phishing attacks steal senior executives' Microsoft logins

The VENOM campaign appears to have been active since at least early April, targeting senior executives with phishing attacks designed to steal Microsoft credentials. The mechanics, as BleepingComputer describes them, are built around bypassing the defences that most organisations assume are doing their job — multi-factor authentication workarounds being the obvious concern whenever credential-harvesting goes after accounts with enterprise-wide access. The targeting logic is straightforward and depressingly familiar: C-suite accounts carry the broadest permissions, the people holding them are under constant pressure to act quickly on communications, and they are statistically less likely to have been walked through security awareness training with the same rigour applied to junior staff. That asymmetry has been exploited for years. VENOM, if it is what it appears to be, is another campaign betting that the gap between executive access and executive vigilance remains wide enough to drive a phishing kit through.

If confirmed, here is what this means. Organisations running Microsoft 365 environments with executives who rely on standard MFA — SMS codes, authenticator app prompts — should treat their current configuration as insufficient against an adversary using session-hijacking or adversary-in-the-middle proxies, which is the most likely technical approach behind campaigns of this type. The second-order effect is the real danger: a compromised executive account is not just an email problem. It becomes a launchpad for business email compromise fraud, internal trust exploitation, and access to financial or strategic systems that nobody thought to restrict because the executive was assumed to be the trusted party. Security teams should be auditing conditional access policies and phishing-resistant MFA adoption at the leadership level specifically — not because executives are careless, but because they are the explicit target.

Watch for additional victims or incident reports surfacing that corroborate the campaign's scope and confirm whether the credential-bypass technique is a known proxy method or something less well-documented. Any second source picking up the story independently would move this well past pinch-of-salt territory.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →