Menace actors are abusing HTTP shopper instruments like Axios at the side of Microsoft’s Direct Ship function to type a “extremely environment friendly assault pipeline” in latest phishing campaigns, based on new findings from ReliaQuest.
“Axios person agent exercise surged 241% from June to August 2025, dwarfing the 85% development of all different flagged person brokers mixed,” the cybersecurity firm mentioned in a report shared with The Hacker Information. “Out of 32 flagged person brokers noticed on this timeframe, Axios accounted for twenty-four.44% of all exercise.”
The abuse of Axios was beforehand flagged by Proofpoint in January 2025, detailing campaigns using HTTP purchasers to ship HTTP requests and obtain HTTP responses from net servers to conduct account takeover (ATO) assaults on Microsoft 365 environments.
ReliaQuest advised The Hacker Information that there is no such thing as a proof to recommend these actions are associated, including that the software is usually exploited alongside widespread phishing kits. “The usefulness of Axios means it’s nearly definitely being adopted by all varieties of risk actors no matter sophistication ranges or motivation,” the corporate added.
Equally, phishing campaigns have additionally been noticed more and more utilizing a professional function in Microsoft 365 (M365) referred to as Direct Ship to spoof trusted customers and distribute e-mail messages.
In amplifying Axios abuse by way of Microsoft Direct Ship, the assault goals to weaponize a trusted supply methodology to make sure that their messages slip previous safe gateways and land in customers’ inboxes. Certainly, assaults that paired Axios with Direct Ship have been discovered to attain a 70% success price in latest campaigns, surging previous non-Axios campaigns with “unparalleled effectivity.”
The marketing campaign noticed by ReliaQuest is claimed to have commenced in July 2025, initially singling out executives and managers in finance, well being care, and manufacturing sectors, earlier than increasing its focus to focus on all customers.
Calling the method a sport changer for attackers, the corporate identified that the marketing campaign not solely is profitable at bypassing conventional safety defenses with improved precision, but in addition allows them to mount phishing operations at an unprecedented scale.
In these assaults, Axios is used to intercept, modify, and replay HTTP requests, thereby making it potential to seize session tokens or multi-factor authentication (MFA) codes in real-time or exploit SAS tokens in Azure authentication workflows to realize entry to delicate sources.
“Attackers use this blind spot to bypass MFA, hijack session tokens, and automate phishing workflows,” ReliaQuest mentioned. “The customizability provided by Axios lets attackers tailor their exercise to additional mimic professional workflows.”
The e-mail messages contain utilizing compensation-themed lures to trick recipients into opening PDF paperwork containing malicious QR codes, which, when scanned, direct customers to faux login pages mimicking Microsoft Outlook to facilitate credential theft. As an additional layer of protection evasion, a few of these pages are hosted on Google Firebase infrastructure to capitalize on the status of the app growth platform.
Apart from reducing the technical barrier for stylish assaults, Axios’s prevalence in enterprise and developer setups additionally implies that it gives attackers a method to mix in with common site visitors and fly underneath the radar.
To mitigate the chance posed by this risk, organizations are suggested to safe Direct Ship and disable it if not required, configure acceptable anti-spoofing insurance policies on e-mail gateways, prepare staff to acknowledge phishing emails, and block suspicious domains.
“Axios amplifies the affect of phishing campaigns by bridging the hole between preliminary entry and full-scale exploitation. Its capacity to control authentication workflows and replay HTTP requests permits attackers to weaponize stolen credentials in methods which can be each scalable and exact.”
“This makes Axios integral to the rising success of Direct Ship phishing campaigns, displaying how attackers are evolving past conventional phishing techniques to take advantage of authentication programs and APIs at a stage that conventional defenses are ill-equipped to deal with.”
The event comes as Mimecast detailed a large-scale credential harvesting marketing campaign concentrating on hospitality trade professionals by impersonating trusted resort administration platforms Expedia Associate Central and Cloudbeds in emails that declare to be visitor reserving confirmations and companion central notifications.
“This credential harvesting operation leverages the routine nature of resort reserving communications,” the corporate mentioned. “The marketing campaign employs pressing, business-critical topic traces designed to immediate fast motion from resort managers and employees.”
The findings additionally observe the invention of an ongoing marketing campaign that has employed a nascent phishing-as-a-service (PhaaS) providing referred to as Salty 2FA to steal Microsoft login credentials and sidestep MFA by simulating six completely different strategies: SMS authentication, authenticator apps, cellphone calls, push notifications, backup codes, and {hardware} tokens.
The assault chain is notable for leveraging providers like Aha[.]io to stage preliminary touchdown pages that masquerade as OneDrive sharing notifications to deceive e-mail recipients and trick them into clicking on faux hyperlinks that redirect to credential harvesting pages, however not earlier than finishing a Cloudflare Turnstile verification verify to filter automated safety instruments and sandboxes.
The phishing pages additionally embrace different superior options like geofencing and IP filtering to dam site visitors from recognized safety vendor IP deal with ranges and cloud suppliers, disable shortcuts to launch developer instruments in net browsers, and assign new subdomains for every sufferer session. In incorporating these strategies, the tip objective is to complicate evaluation efforts.
These findings illustrate how phishing assaults have matured into enterprise-grade operations, using superior evasion techniques and convincing MFA simulations, whereas exploiting trusted platforms and mimicking company portals to make it more durable to differentiate between actual and fraudulent exercise.
“The phishing equipment implements dynamic branding performance to boost social engineering effectiveness,” Ontinue mentioned. “Technical evaluation reveals the malicious infrastructure maintains a company theme database that robotically customizes fraudulent login interfaces based mostly on sufferer e-mail domains.”
“Salty2FA demonstrates how cybercriminals now method infrastructure with the identical methodical planning that enterprises use for their very own programs. What makes this notably regarding is how these strategies blur the road between professional and malicious site visitors.”
