New VoidProxy Phishing Service Bypasses MFA on Microsoft and Google Accounts

Okta Threat Intelligence exposes VoidProxy, a new PhaaS platform. Learn how this advanced service uses the Adversary-in-the-Middle technique to bypass MFA and how to protect yourself from attacks targeting Microsoft and Google accounts

A new online fraud service, named VoidProxy, has been exposed by cybersecurity researchers at Okta Threat Intelligence. In a detailed report, dated September 11, 2025, and shared with Hackread.com, the team revealed that VoidProxy is a Phishing-as-a-Service (PhaaS), a platform that provides all the tools needed to launch cyberattacks.

The platform allows attackers to bypass common multi-factor authentication (MFA) method, a security system that requires a code in addition to a password to prove your identity. The service uses a technique called Adversary-in-the-Middle (AitM) to intercept passwords, MFA codes, and other information in real-time.

Understanding the Attack

Okta’s investigation revealed that an attack typically begins with a deceptive email sent from a compromised account of ...