Risk actors are abusing HTTP shopper instruments like Axios at the side of Microsoft’s Direct Ship function to kind a “extremely environment friendly assault pipeline” in current phishing campaigns, in response to new findings from ReliaQuest.
“Axios person agent exercise surged 241% from June to August 2025, dwarfing the 85% development of all different flagged person brokers mixed,” the cybersecurity firm stated in a report shared with The Hacker Information. “Out of 32 flagged person brokers noticed on this timeframe, Axios accounted for twenty-four.44% of all exercise.”
The abuse of Axios was beforehand flagged by Proofpoint in January 2025, detailing campaigns using HTTP purchasers to ship HTTP requests and obtain HTTP responses from internet servers to conduct account takeover (ATO) assaults on Microsoft 365 environments.
ReliaQuest informed The Hacker Information that there isn’t a proof to counsel these actions are associated, including that the device is repeatedly exploited alongside standard phishing kits. “The usefulness of Axios means it’s nearly definitely being adopted by all kinds of risk actors no matter sophistication ranges or motivation,” the corporate added.
Equally, phishing campaigns have additionally been noticed more and more utilizing a professional function in Microsoft 365 (M365) known as Direct Ship to spoof trusted customers and distribute e-mail messages.
In amplifying Axios abuse by Microsoft Direct Ship, the assault goals to weaponize a trusted supply technique to make sure that their messages slip previous safe gateways and land in customers’ inboxes. Certainly, assaults that paired Axios with Direct Ship have been discovered to realize a 70% success charge in current campaigns, surging previous non-Axios campaigns with “unparalleled effectivity.”
The marketing campaign noticed by ReliaQuest is claimed to have commenced in July 2025, initially singling out executives and managers in finance, well being care, and manufacturing sectors, earlier than increasing its focus to focus on all customers.
Calling the strategy a recreation changer for attackers, the corporate identified that the marketing campaign not solely is profitable at bypassing conventional safety defenses with improved precision, but in addition allows them to mount phishing operations at an unprecedented scale.
In these assaults, Axios is used to intercept, modify, and replay HTTP requests, thereby making it doable to seize session tokens or multi-factor authentication (MFA) codes in real-time or exploit SAS tokens in Azure authentication workflows to realize entry to delicate sources.
“Attackers use this blind spot to bypass MFA, hijack session tokens, and automate phishing workflows,” ReliaQuest stated. “The customizability provided by Axios lets attackers tailor their exercise to additional mimic professional workflows.”
The e-mail messages contain utilizing compensation-themed lures to trick recipients into opening PDF paperwork containing malicious QR codes, which, when scanned, direct customers to pretend login pages mimicking Microsoft Outlook to facilitate credential theft. As an additional layer of protection evasion, a few of these pages are hosted on Google Firebase infrastructure to capitalize on the repute of the app growth platform.
Apart from decreasing the technical barrier for classy assaults, Axios’s prevalence in enterprise and developer setups additionally signifies that it provides attackers a approach to mix in with common site visitors and fly below the radar.
To mitigate the danger posed by this risk, organizations are suggested to safe Direct Ship and disable it if not required, configure acceptable anti-spoofing insurance policies on e-mail gateways, prepare workers to acknowledge phishing emails, and block suspicious domains.
“Axios amplifies the impression of phishing campaigns by bridging the hole between preliminary entry and full-scale exploitation. Its means to control authentication workflows and replay HTTP requests permits attackers to weaponize stolen credentials in methods which might be each scalable and exact.”
“This makes Axios integral to the rising success of Direct Ship phishing campaigns, displaying how attackers are evolving past conventional phishing techniques to use authentication programs and APIs at a stage that conventional defenses are ill-equipped to deal with.”
The event comes as Mimecast detailed a large-scale credential harvesting marketing campaign concentrating on hospitality business professionals by impersonating trusted resort administration platforms Expedia Accomplice Central and Cloudbeds in emails that declare to be visitor reserving confirmations and accomplice central notifications.
“This credential harvesting operation leverages the routine nature of resort reserving communications,” the corporate stated. “The marketing campaign employs pressing, business-critical topic traces designed to immediate instant motion from resort managers and employees.”
The findings additionally observe the invention of an ongoing marketing campaign that has employed a nascent phishing-as-a-service (PhaaS) providing known as Salty 2FA to steal Microsoft login credentials and sidestep MFA by simulating six totally different strategies: SMS authentication, authenticator apps, telephone calls, push notifications, backup codes, and {hardware} tokens.
The assault chain is notable for leveraging providers like Aha[.]io to stage preliminary touchdown pages that masquerade as OneDrive sharing notifications to deceive e-mail recipients and trick them into clicking on pretend hyperlinks that redirect to credential harvesting pages, however not earlier than finishing a Cloudflare Turnstile verification examine to filter automated safety instruments and sandboxes.
The phishing pages additionally embrace different superior options like geofencing and IP filtering to dam site visitors from recognized safety vendor IP deal with ranges and cloud suppliers, disable shortcuts to launch developer instruments in internet browsers, and assign new subdomains for every sufferer session. In incorporating these strategies, the tip objective is to complicate evaluation efforts.
These findings illustrate how phishing assaults have matured into enterprise-grade operations, using superior evasion techniques and convincing MFA simulations, whereas exploiting trusted platforms and mimicking company portals to make it more durable to differentiate between actual and fraudulent exercise.
“The phishing equipment implements dynamic branding performance to boost social engineering effectiveness,” Ontinue stated. “Technical evaluation reveals the malicious infrastructure maintains a company theme database that mechanically customizes fraudulent login interfaces based mostly on sufferer e-mail domains.”
“Salty2FA demonstrates how cybercriminals now strategy infrastructure with the identical methodical planning that enterprises use for their very own programs. What makes this notably regarding is how these strategies blur the road between professional and malicious site visitors.”
