VoidProxy Phishing Kit Beats MFA on Microsoft 365

The email comes from Constant Contact. Not a domain that resembles Constant Contact, not a lookalike registered last Tuesday. The real sending infrastructure, with SPF, DKIM, and DMARC all passing, because the account behind it belongs to a genuine customer who lost their password. Your gateway forwards it. The link is a TinyURL. Four redirects later you are on a .sbs domain sitting behind Cloudflare, looking at a Microsoft 365 sign in page that is neither a screenshot nor a static clone. It is a live relay. Everything you type reaches Microsoft, and everything Microsoft sends back reaches someone else first.

Key Takeaways

• Okta Threat Intelligence published its teardown of VoidProxy, an adversary in the middle phishing as a service framework, on September 11, 2025, after tracking linked attacks since January 2025.
• VoidProxy sends its lures from compromised accounts at legitimate email service providers including Constant Contact, ActiveCampaign, and NotifyVisitors, so the messages arrive with passing SPF, DKIM, and DMARC from a reputable sending domain.
• The framework relays Microsoft 365 and Google Workspace sign ins in real time, capturing the username, the password, the one time code or push approval, and the session cookie issued after MFA succeeds.
• Accounts federated to a third party identity provider such as Okta receive a second stage page that impersonates the SSO handoff, so single sign on is not a mitigation.
• Okta reported that accounts enrolled in phishing resistant authenticators, including FIDO2 security keys and Okta FastPass, could not be phished by VoidProxy at all.

What Is VoidProxy?

VoidProxy is a phishing as a service platform that puts a reverse proxy between the victim and the real Microsoft or Google login servers, so that credentials, MFA responses, and session tokens are all captured in transit during a single sign in event. Okta Threat Intelligence, which published the analysis, calls it mature, scalable, and evasive, and notes that dark web advertisements for the service appear to date back to August 2024.

Operators rent it rather than build it. The backend runs on ephemeral infrastructure fronted by dynamic DNS services such as sslip.io and nip.io, and customers get an admin panel that shows captured accounts in real time, with Telegram bot and webhook integrations for exfiltrating the haul. The proxy does not need to render a convincing fake, because the page the victim sees is the genuine Microsoft or Google page, relayed.

Why Do the Lures Pass SPF, DKIM, and DMARC?

Because they are sent by the email service providers themselves, using stolen customer credentials rather than spoofed headers. BleepingComputer reported that the campaigns originate from hijacked accounts at Constant Contact, ActiveCampaign, and NotifyVisitors. Every authentication check an email gateway runs is a check on the sending infrastructure, and the sending infrastructure is exactly what the attacker borrowed.

This is the uncomfortable part of the story, and most coverage skips past it to the MFA bypass. Authentication protocols answer one question: did this domain really send this message? They do not answer whether the account that pressed send was under its owner's control. An ESP that reliably delivers a million legitimate newsletters is, by construction, an excellent delivery channel for whatever a stolen login inside it chooses to send.

Gblock has covered the same pattern from the other direction before, in hijacked Outlook mailboxes that relay live Microsoft 365 session cookies and in OAuth device code phishing against Microsoft 365. VoidProxy is the version that starts one hop earlier, inside the marketing stack.

How Does the Redirect Chain Evade Analysis?

It stacks four independent filters, each of which is individually boring and collectively very hard for an automated scanner to walk. Okta describes the chain in order: a shortened link such as TinyURL with multiple hops, a first stage page on a disposable domain using a low cost TLD, a Cloudflare CAPTCHA, and a Cloudflare Worker acting as gatekeeper and lure loader.

• Shortened links with multiple hops. A URL scanner that resolves one redirect and stops sees nothing suspicious.
• Disposable low cost TLDs. Okta observed .icu, .sbs, .cfd, .xyz, .top, and .home, with new domains appearing daily, which defeats reputation lists that need time to warm up.
• Cloudflare in front. The CAPTCHA filters out headless crawlers while making the page feel more legitimate to a human, and Cloudflare's network hides the real backend IP.
• Cloudflare Workers as a cloaking layer. Traffic that does not match the target profile gets a bland "welcome" page. Only the intended victim is served the login lure.

Blocklisting is structurally the wrong tool here. Every layer in that chain is either a mainstream service or a domain that will be dead before anyone reports it.

What Happens to Accounts Federated Through Okta?

They get a second stage. When VoidProxy detects that an address belongs to an organization using a third party identity provider, it serves an additional phishing page that impersonates the Microsoft 365 or Google service provider initiated SSO flow, and proxies those requests onward to the real Okta servers. Non federated users are relayed straight to Microsoft or Google.

The security lesson is unwelcome but clean. Consolidating logins behind an identity provider reduces password sprawl; it does not make the login ceremony itself unphishable. Anything a user can be talked into typing or tapping can be relayed, and that includes one time codes and push approvals. CISA's guidance is blunt about the hierarchy: FIDO and WebAuthn are the only widely available phishing resistant authentication, and everything else is a step down.

Why Email Users Should Care

The lure does not arrive from a stranger. It arrives through the same trusted marketing pipe that delivers your newsletters, receipts, and webinar invitations, from platforms whose entire business is landing in the inbox rather than the spam folder. If you have trained yourself to check the sender domain before clicking, VoidProxy passes that check. So does anything else that rents a compromised ESP account.

That trust surface is the same one marketing email already uses for less dramatic purposes. Constant Contact and ActiveCampaign messages routinely carry open tracking and rewritten click tracking links, which is why Gblock has separate breakdowns of what Constant Contact tracks in your inbox. The relevant point for security teams is narrower: a redirect through a marketing platform's link wrapper is so normal that a redirect chain no longer looks like an anomaly.

User training does not close this gap either. David Shipley of Beauceron Security told CSO Online that immediately after training, the chance someone clicks a phish is still 3.5%, and that it climbs back to 15% after 90 days. In a 1,000 person company, that is 35 clicks on a good day and 150 once the training has faded. A control with a 15% failure rate is not a control.

What Actually Stops It

One thing does, and Okta's own telemetry is the evidence: accounts using phishing resistant authenticators could not be tricked into releasing a credential, and in several cases received warnings that their account was under attack. A FIDO2 credential is cryptographically bound to the origin that registered it, so a browser sitting on a .sbs domain simply has nothing to hand over, no matter how convincing the page looks or how willing the user is.

Concrete steps, in the order that buys the most risk reduction:

• Enroll users in passkeys, FIDO2 security keys, or smart cards, and enforce them by policy. Enrollment without enforcement leaves the weaker factor available as a fallback, which is the factor the attacker will target.
• Restrict sensitive applications to managed, security posture checked devices, so a stolen cookie replayed from unmanaged hardware fails the device check.
• Apply IP session binding to administrative applications and force re authentication before sensitive admin actions, which shortens the useful life of a hijacked session.
• Raise the assurance requirement for sign ins from rarely used networks or anomalous locations, and wire behavioral risk detection to automatic session revocation.
• Hunt for the artifacts, not the domains. Sessions created seconds apart from two geographies, new MFA factors registered right after a sign in, and mail forwarding rules created within minutes of authentication are all more durable signals than a domain list that turns over daily.

Johannes Ullrich of the SANS Institute put the underlying principle plainly in the same CSO report: any method that lets users choose which credential to hand to a site is not phishing safe. Passkeys match the credential to the origin automatically, and that automation is the whole defense.

The Takeaway

VoidProxy is worth studying less as a specific campaign and more as a demonstration that two controls most organizations consider settled, email authentication and MFA, can both be satisfied by an attacker in the same thirty second interaction. SPF, DKIM, and DMARC verified the sender honestly; the sender was simply stolen. MFA completed honestly; the token was simply copied. Neither control malfunctioned.

The one layer VoidProxy could not get past was the one that removes human judgment from the loop entirely. If your rollout of phishing resistant authentication is still scheduled for next quarter, this is the threat model that should move it up.