VoidProxy

VoidProxy is a phishing as a service (PhaaS) platform that primarily targets MFA bypass of Google Workspace and Microsoft 365 accounts.

Push Security has noticed a significant increase in detections associated with VoidProxy over the course of summer 2026. By September 2026, VoidProxy had become one of the most prevalent phishing kits blocked for our customers.

URL patterns

Earlier versions of VoidProxy used distinctive naming patterns in its proxied domains. The main tab URLs for the phishing domains were:

• accounts.<domain> for Google Workspace
• login.<domain> for Microsoft 365

Proxied CDN resources and telemetry hosts were mapped to the following highly recognisable subdomain patterns:

• securedauthxx<rand>.<domain> for Google Workspace
• newnewdomnew<rand>.<domain> for Microsoft 365

These subdomain patterns have been changed since then as part of the kit's attempts to remove previously documented IOCs. The accounts and login tab URL subdomains still appear to be a default option, but many of the phishing attacks using VoidProxy in the wild avoid them now. The proxied CDN resources and telemetry host subdomain mappings changed to a static suffix:

• <rand>bhaedeihch.<domain> - Google Workspace static files
• <rand>ebehbcgcih.<domain> - Google Workspace CheckConnection
• <rand>eageegidjj.<domain> - Microsoft 365 CDN
• <rand>bfajbbibej.<domain> - Microsoft 365 telemetry

Some static subdomain patterns have remained in place:

• play.<domain> - Google Workspace POST /log?hasfast=true&authuser=0&format=json
• financeline.<domain> - Microsoft 365 GET /Me.htm?v=3 (early VoidProxy did not proxy this request)
• portal.<domain> - Microsoft 365 GET /Prefetch/Prefetch.aspx

Network traffic

VoidProxy acts as a reverse proxy with the majority of traffic simply looking the same as a genuine sign-in flow, but through the malicious proxy domain. Some of the request paths are randomised to avoid detection. For example, when phishing Microsoft 365, the sign-in page loads from a random encoded URL parameter rather than /common/oauth2/v2.0/authorize?client_id=....

The VoidProxy handshake

After passing the anti-bot gate, the client-side JavaScript performs a handshake with the server to retrieve the phishing page URL to redirect to. The handshake works by appending a random number to a chosen prefix, taking the SHA-256 hash, and sending it to the server for verification. The server then responds with an encoded URL.

In early versions of VoidProxy, the prefix to the hash input was the static 'secret' VoidProxY. The signed random number was sent as the authvp parameter:

let url  = new URL(atob(location.search.split('=').slice(1).join('=')));
let rand = Math.floor(Math.random() * 1000000).toString();
let sig  = await sha256hex('VoidProxY' + rand);
let r    = await fetch(url.origin + '?authvp=' + rand + '-' + sig, { method: 'GET' });
let body = await r.text();

// Decode the redirect URL
let decoded = atob(body.split('').reverse().join('').replaceAll('$', '='));

In 2026, this handshake was updated to remove the fixed strings. The prefix to the hash input is now derived from the URL of the landing page. The same value is also used as the URL parameter that the signed random number is sent in:

const url  = new URL(location.href);
const rand = Math.floor(Math.random() * 1000000).toString();

// Secret = first path segment, else the first query-parameter name
const name = (url.pathname !== '/' ? url.pathname.substring(1)
                                    : url.searchParams.keys().next().value || '');

const sig  = await sha256hex(name + rand);
const res  = await fetch(url.origin + '?' + name + '1=' + rand + '-' + sig)