Risk actors are abusing HTTP shopper instruments like Axios together with Microsoft’s Direct Ship characteristic to type a “extremely environment friendly assault pipeline” in latest phishing campaigns, in response to new findings from ReliaQuest.
“Axios person agent exercise surged 241% from June to August 2025, dwarfing the 85% development of all different flagged person brokers mixed,” the cybersecurity firm mentioned in a report shared with The Hacker Information. “Out of 32 flagged person brokers noticed on this timeframe, Axios accounted for twenty-four.44% of all exercise.”
The abuse of Axios was beforehand flagged by Proofpoint in January 2025, detailing campaigns using HTTP shoppers to ship HTTP requests and obtain HTTP responses from internet servers to conduct account takeover (ATO) assaults on Microsoft 365 environments.
ReliaQuest informed The Hacker Information that there is no such thing as a proof to counsel these actions are associated, including that the software is often exploited alongside common phishing kits. “The usefulness of Axios means it’s virtually actually being adopted by all varieties of menace actors no matter sophistication ranges or motivation,” the corporate added.
Equally, phishing campaigns have additionally been noticed more and more utilizing a legit characteristic in Microsoft 365 (M365) referred to as Direct Ship to spoof trusted customers and distribute electronic mail messages.
In amplifying Axios abuse by means of Microsoft Direct Ship, the assault goals to weaponize a trusted supply methodology to make sure that their messages slip previous safe gateways and land in customers’ inboxes. Certainly, assaults that paired Axios with Direct Ship have been discovered to realize a 70% success charge in latest campaigns, surging previous non-Axios campaigns with “unparalleled effectivity.”
The marketing campaign noticed by ReliaQuest is alleged to have commenced in July 2025, initially singling out executives and managers in finance, well being care, and manufacturing sectors, earlier than increasing its focus to focus on all customers.
Calling the method a sport changer for attackers, the corporate identified that the marketing campaign not solely is profitable at bypassing conventional safety defenses with improved precision, but in addition permits them to mount phishing operations at an unprecedented scale.
In these assaults, Axios is used to intercept, modify, and replay HTTP requests, thereby making it potential to seize session tokens or multi-factor authentication (MFA) codes in real-time or exploit SAS tokens in Azure authentication workflows to realize entry to delicate assets.
“Attackers use this blind spot to bypass MFA, hijack session tokens, and automate phishing workflows,” ReliaQuest mentioned. “The customizability supplied by Axios lets attackers tailor their exercise to additional mimic legit workflows.”
The e-mail messages contain utilizing compensation-themed lures to trick recipients into opening PDF paperwork containing malicious QR codes, which, when scanned, direct customers to faux login pages mimicking Microsoft Outlook to facilitate credential theft. As an additional layer of protection evasion, a few of these pages are hosted on Google Firebase infrastructure to capitalize on the repute of the app improvement platform.
Apart from reducing the technical barrier for classy assaults, Axios’s prevalence in enterprise and developer setups additionally signifies that it presents attackers a strategy to mix in with common visitors and fly below the radar.
To mitigate the chance posed by this menace, organizations are suggested to safe Direct Ship and disable it if not required, configure applicable anti-spoofing insurance policies on electronic mail gateways, prepare workers to acknowledge phishing emails, and block suspicious domains.
“Axios amplifies the impression of phishing campaigns by bridging the hole between preliminary entry and full-scale exploitation. Its skill to control authentication workflows and replay HTTP requests permits attackers to weaponize stolen credentials in methods which might be each scalable and exact.”
“This makes Axios integral to the rising success of Direct Ship phishing campaigns, exhibiting how attackers are evolving past conventional phishing ways to use authentication techniques and APIs at a stage that conventional defenses are ill-equipped to deal with.”
The event comes as Mimecast detailed a large-scale credential harvesting marketing campaign focusing on hospitality business professionals by impersonating trusted lodge administration platforms Expedia Associate Central and Cloudbeds in emails that declare to be visitor reserving confirmations and associate central notifications.
“This credential harvesting operation leverages the routine nature of lodge reserving communications,” the corporate mentioned. “The marketing campaign employs pressing, business-critical topic strains designed to immediate fast motion from lodge managers and workers.”
The findings additionally observe the invention of an ongoing marketing campaign that has employed a nascent phishing-as-a-service (PhaaS) providing referred to as Salty 2FA to steal Microsoft login credentials and sidestep MFA by simulating six totally different strategies: SMS authentication, authenticator apps, cellphone calls, push notifications, backup codes, and {hardware} tokens.
The assault chain is notable for leveraging companies like Aha[.]io to stage preliminary touchdown pages that masquerade as OneDrive sharing notifications to deceive electronic mail recipients and trick them into clicking on faux hyperlinks that redirect to credential harvesting pages, however not earlier than finishing a Cloudflare Turnstile verification examine to filter automated safety instruments and sandboxes.
The phishing pages additionally embody different superior options like geofencing and IP filtering to dam visitors from recognized safety vendor IP handle ranges and cloud suppliers, disable shortcuts to launch developer instruments in internet browsers, and assign new subdomains for every sufferer session. In incorporating these methods, the top purpose is to complicate evaluation efforts.
These findings illustrate how phishing assaults have matured into enterprise-grade operations, using superior evasion ways and convincing MFA simulations, whereas exploiting trusted platforms and mimicking company portals to make it more durable to differentiate between actual and fraudulent exercise.
“The phishing package implements dynamic branding performance to boost social engineering effectiveness,” Ontinue mentioned. “Technical evaluation reveals the malicious infrastructure maintains a company theme database that routinely customizes fraudulent login interfaces based mostly on sufferer electronic mail domains.”
“Salty2FA demonstrates how cybercriminals now method infrastructure with the identical methodical planning that enterprises use for their very own techniques. What makes this significantly regarding is how these methods blur the road between legit and malicious visitors.”
