Risk actors are abusing HTTP shopper instruments like Axios along side Microsoft’s Direct Ship function to type a “extremely environment friendly assault pipeline” in current phishing campaigns, based on new findings from ReliaQuest.
“Axios consumer agent exercise surged 241% from June to August 2025, dwarfing the 85% progress of all different flagged consumer brokers mixed,” the cybersecurity firm stated in a report shared with The Hacker Information. “Out of 32 flagged consumer brokers noticed on this timeframe, Axios accounted for twenty-four.44% of all exercise.”
The abuse of Axios was beforehand flagged by Proofpoint in January 2025, detailing campaigns using HTTP purchasers to ship HTTP requests and obtain HTTP responses from internet servers to conduct account takeover (ATO) assaults on Microsoft 365 environments.
ReliaQuest instructed The Hacker Information that there isn’t any proof to recommend these actions are associated, including that the software is usually exploited alongside in style phishing kits. “The usefulness of Axios means it’s virtually definitely being adopted by all kinds of menace actors no matter sophistication ranges or motivation,” the corporate added.
Equally, phishing campaigns have additionally been noticed more and more utilizing a official function in Microsoft 365 (M365) referred to as Direct Ship to spoof trusted customers and distribute e mail messages.
In amplifying Axios abuse via Microsoft Direct Ship, the assault goals to weaponize a trusted supply technique to make sure that their messages slip previous safe gateways and land in customers’ inboxes. Certainly, assaults that paired Axios with Direct Ship have been discovered to realize a 70% success price in current campaigns, surging previous non-Axios campaigns with “unparalleled effectivity.”
The marketing campaign noticed by ReliaQuest is claimed to have commenced in July 2025, initially singling out executives and managers in finance, well being care, and manufacturing sectors, earlier than increasing its focus to focus on all customers.
Calling the strategy a sport changer for attackers, the corporate identified that the marketing campaign not solely is profitable at bypassing conventional safety defenses with improved precision, but additionally permits them to mount phishing operations at an unprecedented scale.
In these assaults, Axios is used to intercept, modify, and replay HTTP requests, thereby making it potential to seize session tokens or multi-factor authentication (MFA) codes in real-time or exploit SAS tokens in Azure authentication workflows to achieve entry to delicate assets.
“Attackers use this blind spot to bypass MFA, hijack session tokens, and automate phishing workflows,” ReliaQuest stated. “The customizability supplied by Axios lets attackers tailor their exercise to additional mimic official workflows.”
The e-mail messages contain utilizing compensation-themed lures to trick recipients into opening PDF paperwork containing malicious QR codes, which, when scanned, direct customers to pretend login pages mimicking Microsoft Outlook to facilitate credential theft. As an additional layer of protection evasion, a few of these pages are hosted on Google Firebase infrastructure to capitalize on the fame of the app improvement platform.
Moreover reducing the technical barrier for stylish assaults, Axios’s prevalence in enterprise and developer setups additionally signifies that it provides attackers a technique to mix in with common visitors and fly beneath the radar.
To mitigate the danger posed by this menace, organizations are suggested to safe Direct Ship and disable it if not required, configure applicable anti-spoofing insurance policies on e mail gateways, practice workers to acknowledge phishing emails, and block suspicious domains.
“Axios amplifies the impression of phishing campaigns by bridging the hole between preliminary entry and full-scale exploitation. Its skill to control authentication workflows and replay HTTP requests permits attackers to weaponize stolen credentials in methods which might be each scalable and exact.”
“This makes Axios integral to the rising success of Direct Ship phishing campaigns, displaying how attackers are evolving past conventional phishing techniques to take advantage of authentication programs and APIs at a degree that conventional defenses are ill-equipped to deal with.”
The event comes as Mimecast detailed a large-scale credential harvesting marketing campaign concentrating on hospitality business professionals by impersonating trusted resort administration platforms Expedia Associate Central and Cloudbeds in emails that declare to be visitor reserving confirmations and associate central notifications.
“This credential harvesting operation leverages the routine nature of resort reserving communications,” the corporate stated. “The marketing campaign employs pressing, business-critical topic traces designed to immediate fast motion from resort managers and workers.”
The findings additionally comply with the invention of an ongoing marketing campaign that has employed a nascent phishing-as-a-service (PhaaS) providing referred to as Salty 2FA to steal Microsoft login credentials and sidestep MFA by simulating six totally different strategies: SMS authentication, authenticator apps, cellphone calls, push notifications, backup codes, and {hardware} tokens.
The assault chain is notable for leveraging companies like Aha[.]io to stage preliminary touchdown pages that masquerade as OneDrive sharing notifications to deceive e mail recipients and trick them into clicking on pretend hyperlinks that redirect to credential harvesting pages, however not earlier than finishing a Cloudflare Turnstile verification verify to filter automated safety instruments and sandboxes.
The phishing pages additionally embrace different superior options like geofencing and IP filtering to dam visitors from identified safety vendor IP tackle ranges and cloud suppliers, disable shortcuts to launch developer instruments in internet browsers, and assign new subdomains for every sufferer session. In incorporating these strategies, the tip purpose is to complicate evaluation efforts.
These findings illustrate how phishing assaults have matured into enterprise-grade operations, using superior evasion techniques and convincing MFA simulations, whereas exploiting trusted platforms and mimicking company portals to make it more durable to differentiate between actual and fraudulent exercise.
“The phishing equipment implements dynamic branding performance to boost social engineering effectiveness,” Ontinue stated. “Technical evaluation reveals the malicious infrastructure maintains a company theme database that mechanically customizes fraudulent login interfaces based mostly on sufferer e mail domains.”
“Salty2FA demonstrates how cybercriminals now strategy infrastructure with the identical methodical planning that enterprises use for their very own programs. What makes this notably regarding is how these strategies blur the road between official and malicious visitors.”
