Microsoft SharePoint Venom attack targets C-suite executives by name

As if life in the C-suite wasn’t stressful enough, it’s now been confirmed that CEOs, chief financial officers, and vice president-level executives have been targeted by a previously unknown Microsoft SharePoint-exploit attack platform called Venom since November 2025. These attacks have not achieved their goals randomly; Rather, victims in at least 20 industry sectors have been singled out by name. Here’s what you need to know about Venom, which, threat intelligence analysts said, “operates through a rotating pool of compromised business email accounts.”

forbesAdobe attacks underway—Windows and Mac users given 72 hours to updateBy davy winder

C-Suite Attack Alert—Poison Spread Using Microsoft SharePoint Notifications

Truth be told, it is not uncommon for threat actors to target senior executives, including C-suite members, in attacks. I mean, if you can compromise the account of one of the top dogs, you’ll likely be stuck with a lot of valuable data payment shit. Nor, for that matter, is it unusual for phishing to be the primary route of such compromise. on researchers black fog Venom Stealer was the first to publish a report on the platform. But what makes Venom technically different, according to Abnormal AI’s threat intelligence experts who have analyzed it in-depth, is “everything from an email engineered to defeat every layer of automated analysis to a credential harvester that enrolls an attacker-controlled MFA device before it even makes it to the target’s browser.” This phishing-as-a-service platform, chartered to paying criminal clients, although it is not advertised in any open vendor criminal marketplaces or underground forums, impersonates Microsoft SharePoint document-sharing information and targets C-suite members by name. It appears that Venom is a closed-access platform that is only being distributed through highly vetted criminal channels, which makes it all the more worrying.

Like most phishing attacks, Venom operators start with an email. A highly targeted, addressed C-suite victims by name, and distributed through a rotating pool of compromised business email accounts. While impersonating a SharePoint document-sharing notification, the email claims to be an internal company alert from a SharePoint environment and includes a QR code for scanning to gain access.

unusual ai report It was pointed out that personalization is one layer of the email’s design, but it also employs others to avoid detection. “To avoid signature-based detection, each email contains thrown HTML elements whose values ​​are randomized upon each send,” the report confirms, “ensuring that no two emails produce the same hash or string match.” It even includes a completely fake email message thread beneath the visible lure. “The thread is built around the target,” the report continued, “with their email prefix parsed into a display name, placed in the ‘From’ field of each message, and accompanied by a generated signature block consisting of their name, a fabricated phone number, their real email address, and their real company website. Randomly generated personas are assumed to be correspondents, while message bodies are created using meeting offers, trade disinformation requests, or fake financial table templates. This is not only a way to fool the recipient into thinking the email is genuine, but it also fools the spam classifiers. For all intents and purposes, email is a perfectly legitimate corporate communication.

The QR code, if the victim is determined not to be a bot or malware detector, leads to a credential harvesting page that may present “their organization’s logo, their own email address pre-filled, and if their account is federated, their actual IDP login page instead of the usual Microsoft form,” the analysis warns, adding, “The experience is indistinguishable from a real sign-in because it is, in every visual respect, real.” When the device went into code mode, the unusual AI went to confirm, the victim doesn’t even see any login form, but instead what is claimed to be a DocuSign notification. Copy a code, click on Microsoft and obviously approve the regular device sign-in request. “That’s an endorsement attack,” the unusual AI said. ‘Microsoft authenticates the target against its own infrastructure and passes the resulting access and refresh tokens directly to the attacker’s polling backend.’ Which means, ultimately, that there are no credential forms to trace, no proxies to identify, and no MFA to intercept. brilliant. Evil genius.

forbesAngry Hacker Releases Microsoft Zero-Day Exploit, 1 Billion Users WarnedBy davy winder

Brian Bell, CEO of FusionAuth, said, “Once the cookie session is stolen, MFA becomes irrelevant. No password, no second factor – just a valid session that your system already trusts.” If you’re not implementing persistent verification, ephemeral sessions, device context, and real-time revocation, Bell advised, attackers won’t need to break in because they’ll already be inside. “Venom makes one thing clear: credential rotation is not a recovery strategy. If the attacker is still on the endpoint, you are simply handing them new keys.” Identity infrastructure can no longer be about recovering from a breach, but must instead be about operating securely during a breach “through short-lived, tightly scoped tokens and constant verification,” Bell concluded, “without it, organizations are not really removing the risk.”

Now you know about Venom and Microsoft SharePoint charms, so make sure to act accordingly if you encounter one.