[{"data":1,"prerenderedAt":1340},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":35,"trust-badges":98,"solution-nav":119,"mega-nav":264,"fa-icon-solid-faDisplay":419,"fa-icon-solid-faFilter":422,"fa-icon-solid-faCloudArrowUp":424,"fa-icon-solid-faEnvelope":427,"fa-icon-sharp-regular-faUserSecret":429,"fa-icon-sharp-regular-faBrainCircuit":432,"fa-icon-sharp-regular-faShieldCheck":434,"fa-icon-sharp-regular-faRadar":436,"fa-icon-solid-faMobileScreenButton":438,"fa-icon-sharp-regular-faSatelliteDish":441,"fa-icon-brands-faChrome":443,"fa-icon-sharp-regular-faPenNib":445,"fa-icon-sharp-regular-faBooks":447,"fa-icon-sharp-regular-faBriefcase":449,"fa-icon-sharp-regular-faBookOpenCover":451,"fa-icon-sharp-regular-faBrowser":453,"fa-icon-sharp-regular-faBook":455,"fa-icon-sharp-regular-faGrid":457,"fa-icon-sharp-regular-faBuilding":459,"fa-icon-sharp-regular-faHandshakeSimple":461,"fa-icon-sharp-regular-faArrowTrendUp":463,"fa-icon-sharp-regular-faCalendarStar":465,"fa-icon-sharp-regular-faNewspaper":467,"fa-icon-sharp-regular-faUsers":469,"fa-icon-sharp-regular-faMessagesQuestion":471,"threat-intelligence-tool:voidproxy":473,"threat-intelligence-evasion:voidproxy":33,"threat-intelligence-payloads:voidproxy":33,"threat-intelligence-global":1149,"threat-intelligence-technique-table":1287},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":20,"data":21,"variations":26,"lastUpdated":27,"firstPublished":28,"testRatio":29,"createdBy":30,"lastUpdatedBy":31,"folders":32,"lastUpdateSource":33,"stageModifiedSincePublish":6,"rev":34},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},768,640,320,"data",[],{"link":22,"text":23,"type":24,"url":25},{},"Get the latest stats and analysis on browser-based attacks","web-banner","https:\u002F\u002Fpushsecurity.com\u002Fresources\u002Fbrowser-attacks",{},1790775413052,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],null,"v9c05zm0mil",{"createdBy":36,"createdDate":37,"data":38,"folders":86,"id":87,"lastUpdated":88,"lastUpdatedBy":36,"meta":89,"modelId":92,"name":93,"published":13,"query":94,"testRatio":29,"variations":95,"firstPublished":96,"stageModifiedSincePublish":6,"lastUpdateSource":33,"rev":97},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":39,"inputs":40,"text":41,"url":42,"blocks":43,"state":82},"ewrererw",[],"testrfesssssssssss","",[44,71],{"@type":45,"@version":46,"id":47,"component":48,"responsiveStyles":61},"@builder.io\u002Fsdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":49,"tag":49,"options":50,"isRSC":33},"TopBannerContent",{"text":51,"ctaText":52,"url":53,"mainText":54,"cta":57,"styleVariant":60,"showMonsters":6},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https:\u002F\u002Fpushsecurity.com\u002Fwebinar\u002Fstate-of-browser-security",{"content":55,"fontSize":56},"\u003Cp class=\"\">\u003Cstrong>Get a free browser security assessment and find what your current tools miss\u003C\u002Fstrong>\u003C\u002Fp>","text-base",{"content":58,"fontSize":56,"url":59},"\u003Cp class=\"\">Request Assessment\u003C\u002Fp>","https:\u002F\u002Fpushsecurity.com\u002Flp\u002Fbrowser-security-assessment","default",{"large":62},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67,"marginTop":68,"marginBottom":68,"fontSize":69,"fontWeight":70},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"id":72,"@type":45,"tagName":73,"properties":74,"responsiveStyles":77},"builder-pixel-6kql2jrn2g9","img",{"src":75,"aria-hidden":76,"alt":42,"width":66,"height":66},"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fpixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true",{"large":78},{"height":66,"width":66,"display":79,"opacity":66,"overflow":80,"pointerEvents":81},"block","hidden","none",{"deviceSize":83,"location":84},"large",{"path":42,"query":85},{},[],"fd266d0172cc47429be7ad10f48c99ad",1792492581845,{"breakpoints":90,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":91},{"medium":16,"small":17,"xsmall":18},"component","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"dezl7amuk0b",[99,103,107,111,115],{"title":100,"logo":101,"createdDate":102},"SOC2","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":104,"logo":105,"createdDate":106},"GDPR","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":108,"logo":109,"createdDate":110},"Cyber essentials","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":112,"logo":113,"createdDate":114},"ISO IEC 27001","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":116,"logo":117,"createdDate":118},"ISO IEC 27701","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[120,189,234],{"id":121,"label":122,"text":42,"navIcon":123,"items":124},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[125,130,135,140,145,150,155,160,165,169,174,179,184],{"title":126,"text":127,"url":128,"navIcon":129},"Phishing","Detect phishing behaviorally in the browser, regardless of the payload or delivery channel.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fzero-day-phishing","sharp-regular:faFishingRod",{"title":131,"text":132,"url":133,"navIcon":134},"Adversary-in-the-Middle","Detect and block MFA-bypassing AiTM phishing pages in real-time.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fadversary-in-the-middle-attacks","solid:faUserSecret",{"title":136,"text":137,"url":138,"navIcon":139},"ClickFix (and variants)","Intercept malicious copy and paste attacks at the point of interaction.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fclickfix-fix-variants","sharp-regular:faLaptopCode",{"title":141,"text":142,"url":143,"navIcon":144},"Device code phishing","Detect and block device code phishing kits designed to get around passkeys.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fdevice-code-phishing","solid:faTabletScreenButton",{"title":146,"text":147,"url":148,"navIcon":149},"Consent phishing","Detect and block malicious OAuth consent grants before access is authorized.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fconsent-phishing","solid:faThumbsUp",{"title":151,"text":152,"url":153,"navIcon":154},"Malicious OAuth integrations","Detect and block the root cause of SaaS supply chain attacks.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-oauth-integrations","solid:faPlugCircleXmark",{"title":156,"text":157,"url":158,"navIcon":159},"Malicious browser extensions","Inventory, monitor, and block risky browser extensions.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":161,"text":162,"url":163,"navIcon":164},"Malicious file downloads","Control which files users can download by type, source, and user group.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-file-downloads","solid:faFileCircleXmark",{"title":166,"text":167,"url":168,"navIcon":164},"Infostealers","Detect infostealer delivery and respond to a compromise.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Finfostealer-malware",{"title":170,"text":171,"url":172,"navIcon":173},"Ghost logins","Surface hidden login paths that bypass SSO and expose accounts.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fghost-logins","solid:faGhost",{"title":175,"text":176,"url":177,"navIcon":178},"Mobile phishing (QR & SMS)","Detect phishing regardless of whether it arrives via email, SMS, or QR code.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmobile-phishing-qr-code-sms","solid:faQrcode",{"title":180,"text":181,"url":182,"navIcon":183},"Credential stuffing","Identify reused and compromised credentials across SaaS logins.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fcredential-stuffing","custom:credentialStuffing",{"title":185,"text":186,"url":187,"navIcon":188},"Session hijacking","Detect and respond to stolen session token replay with browser session markers.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fsession-hijacking","solid:faCookieBite",{"id":190,"label":191,"text":42,"navIcon":192,"items":193},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[194,199,204,209,214,219,224,229],{"title":195,"text":196,"url":197,"navIcon":198},"Stop account takeover","Stop ATO before it happens, in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fstop-account-takeover","sharp-regular:faUserSecret",{"title":200,"text":201,"url":202,"navIcon":203},"Harden unmanaged identities","Identify gaps and harden them with guardrails","\u002Fsolution\u002Fachieve-security-outcomes\u002Fharden-unmanaged-identities","sharp-regular:faRadar",{"title":205,"text":206,"url":207,"navIcon":208},"Investigate browser-related incidents","Investigate and respond with browser telemetry","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":210,"text":211,"url":212,"navIcon":213},"Secure shadow IT","See and control shadow SaaS in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-shadow-saas","sharp-regular:faShieldCheck",{"title":215,"text":216,"url":217,"navIcon":218},"Secure AI","See and control AI apps in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-ai","sharp-regular:faBrainCircuit",{"title":220,"text":221,"url":222,"navIcon":223},"Secure BYOD","Extend security to unmanaged devices without MDM","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-bring-your-own-device","solid:faMobileScreenButton",{"title":225,"text":226,"url":227,"navIcon":228},"Secure Chromebooks","Protect Chromebooks against in-browser attacks","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-chromebooks","brands:faChrome",{"title":230,"text":231,"url":232,"navIcon":233},"Data loss prevention","Enforce DLP at the point of interaction in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":235,"label":236,"text":42,"navIcon":237,"items":238},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[239,244,249,254,259],{"title":240,"text":241,"url":242,"navIcon":243},"Email Security","Stop phishing outside of the inbox.","\u002Fsolution\u002Ftool-replacements\u002Femail-security","faEnvelope",{"title":245,"text":246,"url":247,"navIcon":248},"Remote browser isolation","Detect attacks that happen inside the browser session.","\u002Fsolution\u002Ftool-replacements\u002Fremote-browser-isolation","solid:faDisplay",{"title":250,"text":251,"url":252,"navIcon":253},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","\u002Fsolution\u002Ftool-replacements\u002Fsecure-web-gateways","solid:faFilter",{"title":255,"text":256,"url":257,"navIcon":258},"CASB alternative","Catch browser-based identity threats in real time, not after the fact.","\u002Fsolution\u002Ftool-replacements\u002Fcloud-access-security-broker","solid:faCloudArrowUp",{"title":260,"text":261,"url":262,"navIcon":263},"Security awareness training","Block real phishing instead of training users on simulations.","\u002Fsolution\u002Ftool-replacements\u002Fsecurity-awareness-training","custom:securityAwareness",[265,293,354],{"id":266,"columns":267},"Solution",[268,283],{"kind":269,"heading":270,"span":29,"links":271},"links","Compare Push",[272,275,277,279,281],{"title":273,"url":247,"text":246,"navIcon":248,"variant":274},"vs Remote Browser Isolation","compact",{"title":276,"url":252,"text":251,"navIcon":253,"variant":274},"vs Secure Web Gateways",{"title":278,"url":257,"text":256,"navIcon":258,"variant":274},"vs Cloud Access Security Broker",{"title":280,"url":262,"text":261,"navIcon":263,"variant":274},"vs Security Awareness Training",{"title":282,"url":242,"text":241,"navIcon":243,"variant":274},"+ Email Security",{"kind":269,"heading":266,"span":46,"links":284},[285,286,287,288,289,290,291,292],{"title":195,"url":197,"text":196,"navIcon":198},{"title":215,"url":217,"text":216,"navIcon":218},{"title":230,"url":232,"text":231,"navIcon":233},{"title":210,"url":212,"text":211,"navIcon":213},{"title":200,"url":202,"text":201,"navIcon":203},{"title":220,"url":222,"text":221,"navIcon":223},{"title":205,"url":207,"text":206,"navIcon":208},{"title":225,"url":227,"text":226,"navIcon":228},{"id":294,"columns":295},"resources",[296,321,339],{"kind":269,"heading":297,"span":29,"links":298},"Resources",[299,306,311,316],{"title":300,"url":301,"text":302,"navIcon":303,"variant":304,"badge":305},"Research blog","\u002Fblog","Latest threat research and insights","sharp-regular:faPenNib","featured","Latest",{"title":307,"url":308,"text":309,"navIcon":310},"Resource library","\u002Fresources","Check out our webinars and downloads","sharp-regular:faBooks",{"title":312,"url":313,"text":314,"navIcon":315},"Customer stories","\u002Fcustomer-stories","What customers love about Push","sharp-regular:faBriefcase",{"title":317,"url":318,"text":319,"navIcon":320},"Help center","\u002Fhelp\u002Faudience\u002Fadministrators","Guides for employees and admins","sharp-regular:faBookOpenCover",{"kind":269,"heading":322,"span":29,"links":323},"Learn",[324,329,334],{"title":325,"url":326,"text":327,"navIcon":328},"Browser attacks in 2026","\u002Fresources\u002Fbrowser-attacks","The latest stats & analysis","sharp-regular:faBrowser",{"title":330,"url":331,"text":332,"navIcon":333},"Browser attacks glossary","\u002Fresources\u002Fbrowser-attacks-glossary","Understand the threat landscape","sharp-regular:faBook",{"title":335,"url":336,"text":337,"navIcon":338},"Browser attacks matrix","\u002Fresources\u002Fbrowser-identity-attacks-matrix","MITRE-inspired resource for red & blue teams","sharp-regular:faGrid",{"kind":294,"heading":340,"cards":341},"Latest resources",[342,348],{"title":343,"description":344,"cta":345,"background":347},"Browser-based attacks: the 2026 threat landscape","Half of attacks now reach victims outside of email. ClickFix is now the dominant browser attack technique. Get the latest stats and analysis from the Push Security team.",{"text":346,"url":326},"Read the report","orange",{"title":349,"description":350,"cta":351,"background":353},"The browser & identity attacks matrix","Check out the MITRE-inspired matrix of browser & identity attack techniques for red and blue teams. Get involved on GitHub.",{"text":352,"url":336},"Explore the matrix","black",{"id":355,"columns":356},"About",[357,375,398],{"kind":269,"heading":358,"span":29,"links":359},"Get to know us",[360,365,370],{"title":361,"url":362,"text":363,"navIcon":364},"About us","\u002Fabout","Meet the team and learn what drives us","sharp-regular:faBuilding",{"title":366,"url":367,"text":368,"navIcon":369},"Partners","\u002Fpartner","Become a partner and access resources","sharp-regular:faHandshakeSimple",{"title":371,"url":372,"text":373,"navIcon":374},"Investors","\u002Fabout#investors","Learn more about our investors and advisors","sharp-regular:faArrowTrendUp",{"kind":269,"heading":376,"span":29,"links":377},"Keep up with us",[378,383,388,393],{"title":379,"url":380,"text":381,"navIcon":382},"Events","\u002Fevents","See upcoming webinars and in-person events","sharp-regular:faCalendarStar",{"title":384,"url":385,"text":386,"navIcon":387},"News","\u002Fnews","Stay up to date on company news","sharp-regular:faNewspaper",{"title":389,"url":390,"text":391,"navIcon":392},"Careers","\u002Fcareers","Explore open roles","sharp-regular:faUsers",{"title":394,"url":395,"text":396,"navIcon":397},"Contact us","\u002Fcontact","Have a question? We're here to help","sharp-regular:faMessagesQuestion",{"kind":399,"heading":400,"testimonials":401},"testimonials","What customers say",[402,409,414],{"quote":403,"author":404,"jobTitle":405,"image":406,"url":313,"ctaText":407,"background":408},"Security is only as good as its weakest link. From day one, Push found the gaps that would allow attackers to circumvent our controls. We use Push every day — they're one of my favourite teams to work with.","Jason Waits","\u003Cp>CISO, Inductive Automation\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07","Read the customer story","white",{"quote":410,"author":411,"jobTitle":412,"image":413,"url":313,"ctaText":407,"background":408},"I'm not going to be able to shove a browser on everybody. I need to be able to support them where they are. Push gave us the visibility and control we needed while allowing people to choose their paths.","Myke Lyons","\u003Cp>CISO, Cribl\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F61920ec05c7a45b4b2259b8dded43c9b",{"quote":415,"author":416,"jobTitle":417,"image":418,"url":313,"ctaText":407,"background":408},"No matter the channel for phishing — email, LinkedIn, text — the employee clicks a link that opens a browser session. We see the main control point moving from the endpoint to the browser.","Ash Devata","\u003Cp>CEO, GreyNoise\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F392c75ae282342008130cf1147c20e82",{"w":420,"h":420,"d":421},512,"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":420,"h":420,"d":423},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":425,"h":420,"d":426},576,"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",{"w":420,"h":420,"d":428},"M48 64c-26.5 0-48 21.5-48 48 0 15.1 7.1 29.3 19.2 38.4l208 156c17.1 12.8 40.5 12.8 57.6 0l208-156c12.1-9.1 19.2-23.3 19.2-38.4 0-26.5-21.5-48-48-48L48 64zM0 196L0 384c0 35.3 28.7 64 64 64l384 0c35.3 0 64-28.7 64-64l0-188-198.4 148.8c-34.1 25.6-81.1 25.6-115.2 0L0 196z",{"w":430,"h":420,"d":431},448,"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":420,"h":420,"d":433},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":420,"h":420,"d":435},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":420,"h":420,"d":437},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":439,"h":420,"d":440},384,"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":420,"h":420,"d":442},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":420,"h":420,"d":444},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":425,"h":420,"d":446},"M406.1 198.1l0 0-3.6 10.7-56.3 168.8-221.5 69.9 98.5-98.5c5.2 1.9 10.8 3 16.7 3 26.5 0 48-21.5 48-48s-21.5-48-48-48-48 21.5-48 48c0 5.9 1.1 11.5 3 16.7l-98.5 98.5 69.9-221.5 168.8-56.3 10.8-3.6 0 0 60.1 60.1zM80 512l304-96 64-192c59.4-59.4 96.7-96.7 112-112-18.3-18.3-49.6-49.6-94.1-94.1L432-16C416.7-.7 379.4 36.6 320 96l-192 64-96 304 48 48z",{"w":425,"h":420,"d":448},"M404.8 45.3l12.4 46.4-77.3 20.7-12.4-46.4 77.3-20.7zm5.5 329.8l-58-216.4 77.3-20.7 58 216.4-77.3 20.7zm12.4 46.4l77.3-20.7 12.4 46.4-77.3 20.7-12.4-46.4zM315.1 19.6l-46.4 12.4 8.6 32-69.2 0 0-64-176 0 0 512 304 0 0-228.4c41.8 156.2 63.5 237.1 65.1 243 64.4-17.3 167.4-44.9 170-45.6l-12.4-46.4-107.7-401.8-12.4-46.4C413-6.6 371.7 4.4 315.1 19.6zM208.1 464l0-352 80 0 0 352-80 0zm-48-400l0 32-80 0 0-48 80 0 0 16zm0 80l0 224-80 0 0-224 80 0zm0 272l0 48-80 0 0-48 80 0z",{"w":420,"h":420,"d":450},"M168 0l-24 0 0 96-144 0 0 384 512 0 0-384-144 0 0-96-200 0zM464 256l-416 0 0-112 416 0 0 112zM320 304l144 0 0 128-416 0 0-128 144 0 0 48 128 0 0-48zm0-208l-128 0 0-48 128 0 0 48z",{"w":425,"h":420,"d":452},"M312 114.4l0 282.1 9.2-3.3C367.8 376.5 417 368 466.5 368l61.5 0 0-288-61.5 0c-38.5 0-76.7 6.6-113 19.6L312 114.4zM264 396.5l0-282.1-41.5-14.8C186.2 86.6 148 80 109.5 80l-61.5 0 0 288 61.5 0c49.5 0 98.7 8.5 145.3 25.2l9.2 3.3zM528 32l48 0 0 384-109.5 0c-44 0-87.7 7.6-129.2 22.4L288 456 238.6 438.4C197.2 423.6 153.5 416 109.5 416L0 416 0 32 109.5 32c44 0 87.7 7.6 129.2 22.4L288 72 337.4 54.4C378.8 39.6 422.5 32 466.5 32L528 32zM0 464l91.7 0c36.9 0 73.6 5 109.2 14.9l86.2 24 42.2-15.1c44-15.7 90.5-23.8 137.2-23.8l109.5 0 0 48-109.5 0c-41.3 0-82.2 7.1-121.1 21l-49.4 17.6-7.2 2.6-7.3-2-93.6-26c-31.4-8.7-63.8-13.1-96.4-13.1L0 512 0 464z",{"w":420,"h":420,"d":454},"M48 256l0 144 416 0 0-144-416 0zM0 64l512 0 0 384-512 0 0-384zm64 64l0 64 64 0 0-64-64 0zm120 8l-24 0 0 48 288 0 0-48-264 0z",{"w":430,"h":420,"d":456},"M24 0L0 0 0 432 .4 432c-.2 2.6-.4 5.3-.4 8l0 72 448 0 0-48-32 0 0-64 32 0 0-400-424 0zM368 400l0 64-320 0 0-24c0-22.1 17.9-40 40-40l280 0zM88 352c-14.4 0-28 3.5-40 9.6l0-313.6 352 0 0 304-312 0zm40-224l0 48 224 0 0-48-224 0zm224 96l-224 0 0 48 224 0 0-48z",{"w":420,"h":420,"d":458},"M112 64l0 48-48 0 0-48 48 0zM64 24l-40 0 0 128 128 0 0-128-88 0zm48 208l0 48-48 0 0-48 48 0zM64 192l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zM24 360l0 128 128 0 0-128-128 0zM280 64l0 48-48 0 0-48 48 0zM232 24l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zM400 64l48 0 0 48-48 0 0-48zM360 24l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0z",{"w":439,"h":420,"d":460},"M48 48l0 416 96 0 0-112 96 0 0 112 96 0 0-416-288 0zM0 0L384 0 384 512 0 512 0 0zM96 96l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0zM96 224l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0z",{"w":17,"h":420,"d":462},"M598.6 75.4L618 61.3 589.7 22.5C586 25.2 554.7 48 495.8 90.8l-34.1-22.7-6-4-145.2 0 0 0-144 0c-2.9 2.9-11.1 11.1-24.5 24.5-56.3-40.9-86.6-62.9-90.8-66.1L22.9 61.3c1.5 1.1 37.3 27.1 107.4 78.1l16.6 12.1c7.9-7.9 21.1-21.1 39.5-39.5l76.1 0-103 103-17 17c12.1 12.1 21.8 21.8 29.1 29.1 46.9 46.9 122.8 46.9 169.7 0L368.4 233.9 494.5 360c-16.7 16.7-29.4 29.4-38.1 38.1l-47-47-33.9 33.9 47 47-16 16-44.1 0-65-65-33.9 33.9 31 31-60.1 0-169-169-17-17-33.9 33.9 17 17 176 176 7 7 128 0 1 1 1-1 81.9 0 7-7c225.8-225.8 167.2-167.2 193-193l-33.9-33.9-64 64-143-143-17-17c-6.8 6.8-27.2 27.2-61.1 61.1-26.5 26.5-68.5 28-96.7 4.6l119.8-119.8 62.1 0 0 0 48.7 0c32.6 21.8 51.3 34.2 55.9 37.2l13.5-9.8 88-64z",{"w":425,"h":420,"d":464},"M352 96l224 0 0 224-48 0 0-142.1-191 191-17 17-17-17-111-111-139.8 139.8-17 17-33.9-33.9 17-17 156.8-156.8 17-17 17 17 111 111 174.1-174.1-142.1 0 0-48z",{"w":430,"h":420,"d":466},"M144 0l0 64 160 0 0-64 48 0 0 64 96 0 0 416-448 0 0-416 96 0 0-64 48 0zm0 112l-96 0 0 320 352 0 0-320-256 0zM261.6 228.2l84.1 12.2-60.9 59.3 14.4 83.8-75.2-39.6-75.2 39.6 14.4-83.8-60.9-59.3 84.1-12.2 37.6-76.2 37.6 76.2z",{"w":420,"h":420,"d":468},"M96 32l416 0 0 448-512 0 0-392 48 0 0 344 8 0c22.1 0 40-17.9 40-40L96 32zm38.4 400l329.6 0 0-352-320 0 0 312c0 14.4-3.5 28-9.6 40zM192 128l96 0 0 96-96 0 0-96zm152 48l72 0 0 48-96 0 0-48 24 0zM216 256l200 0 0 48-224 0 0-48 24 0zm0 80l200 0 0 48-224 0 0-48 24 0z",{"w":17,"h":420,"d":470},"M384 128a64 64 0 1 0 -128 0 64 64 0 1 0 128 0zm-176 0a112 112 0 1 1 224 0 112 112 0 1 1 -224 0zm252.8 76c5.9 2.6 12.4 4 19.2 4 26.5 0 48-21.5 48-48s-21.5-48-48-48l-.8 0c-1.6-16.6-5.8-32.4-12.1-47.1 4.2-.6 8.6-.9 12.9-.9 53 0 96 43 96 96s-43 96-96 96c-17.7 0-34.3-4.8-48.6-13.2 11.7-11.3 21.6-24.4 29.4-38.8zM208.6 242.8c-14.2 8.4-30.8 13.2-48.6 13.2-53 0-96-43-96-96s43-96 96-96c4.4 0 8.7 .3 12.9 .9-6.3 14.7-10.5 30.6-12.1 47.1l-.8 0c-26.5 0-48 21.5-48 48s21.5 48 48 48c6.8 0 13.3-1.4 19.2-4 7.8 14.4 17.7 27.5 29.4 38.8zM432 288l69.8 192-51.1 0-52.4-144-156.8 0-52.4 144-51.1 0 69.8-192 224 0zM151.2 304l-17.3 48-36.3 0-46.5 128-51.1 0 64-176 87.2 0zm354.8 48l-17.3-48 87.2 0 64 176-51.1 0-46.5-128-36.3 0z",{"w":425,"h":420,"d":472},"M144 354l-48 30 0-80-96 0 0-336 384 0 0 336-160 0-80 50zm0-56.6c43.5-27.2 65.6-41 66.2-41.4l125.8 0 0-240-288 0 0 240 96 0 0 41.4zM192 416l0-35.4 45.8-28.6 2.2 0 0 64 125.8 0c.6 .4 22.7 14.2 66.2 41.4l0-41.4 96 0 0-240-96 0 0-48 144 0 0 336-96 0 0 80-128-80-160 0 0-48zm0-340c-14.4 0-26.1 11.7-26.1 26.1l-40 0C125.9 65.6 155.5 36 192 36s66.1 29.6 66.1 66.1c0 29.7-17.7 46.9-33.3 55.6-4.5 2.5-8.9 4.8-12.9 6.2l-40 0 0-33.4c1.8-.2 3.6-.4 5.4-.6 9.7-1.1 19-2.1 27.9-7.1 7.5-4.2 12.9-10.1 12.9-20.8 0-14.4-11.7-26.1-26.1-26.1zM172 188l40 0 0 40-40 0 0-40z",{"id":474,"title":475,"aka":33,"body":476,"description":482,"extension":1102,"latest_detection":1103,"meta":1104,"name":1105,"navigation":833,"path":1106,"public_analysis":1107,"published":33,"samples":1112,"seo":1133,"stem":1134,"sub_techniques":1135,"targets":1137,"techniques":1141,"trends":1143,"type":1147,"updated":33,"__hash__":1148},"threatIntelligenceTools\u002Fthreat-intel\u002Fvoidproxy\u002Fpublic.md","Public",{"type":477,"value":478,"toc":1096},"minimark",[479,483,486,491,494,511,514,526,537,566,569,597,601,608,613,616,627,897,900,1092],[480,481,482],"p",{},"VoidProxy is a phishing as a service (PhaaS) platform that primarily targets MFA bypass of\nGoogle Workspace and Microsoft 365 accounts.",[480,484,485],{},"Push Security has noticed a significant increase in detections associated with VoidProxy\nover the course of summer 2026. By September 2026, VoidProxy had become one of the most\nprevalent phishing kits blocked for our customers.",[487,488,490],"h2",{"id":489},"url-patterns","URL patterns",[480,492,493],{},"Earlier versions of VoidProxy used distinctive naming patterns in its proxied domains.\nThe main tab URLs for the phishing domains were:",[495,496,497,505],"ul",{},[498,499,500,504],"li",{},[501,502,503],"code",{},"accounts.\u003Cdomain>"," for Google Workspace",[498,506,507,510],{},[501,508,509],{},"login.\u003Cdomain>"," for Microsoft 365",[480,512,513],{},"Proxied CDN resources and telemetry hosts were mapped to the following highly recognisable\nsubdomain patterns:",[495,515,516,521],{},[498,517,518,504],{},[501,519,520],{},"securedauthxx\u003Crand>.\u003Cdomain>",[498,522,523,510],{},[501,524,525],{},"newnewdomnew\u003Crand>.\u003Cdomain>",[480,527,528,529,532,533,536],{},"These subdomain patterns have been changed since then as part of the kit's attempts\nto remove previously documented IOCs. The ",[501,530,531],{},"accounts"," and ",[501,534,535],{},"login"," tab URL subdomains still appear\nto be a default option, but many of the phishing attacks using VoidProxy in the wild avoid them now.\nThe proxied CDN resources and telemetry host subdomain mappings changed to a static suffix:",[495,538,539,545,554,560],{},[498,540,541,544],{},[501,542,543],{},"\u003Crand>bhaedeihch.\u003Cdomain>"," - Google Workspace static files",[498,546,547,550,551],{},[501,548,549],{},"\u003Crand>ebehbcgcih.\u003Cdomain>"," - Google Workspace ",[501,552,553],{},"CheckConnection",[498,555,556,559],{},[501,557,558],{},"\u003Crand>eageegidjj.\u003Cdomain>"," - Microsoft 365 CDN",[498,561,562,565],{},[501,563,564],{},"\u003Crand>bfajbbibej.\u003Cdomain>"," - Microsoft 365 telemetry",[480,567,568],{},"Some static subdomain patterns have remained in place:",[495,570,571,579,589],{},[498,572,573,550,576],{},[501,574,575],{},"play.\u003Cdomain>",[501,577,578],{},"POST \u002Flog?hasfast=true&authuser=0&format=json",[498,580,581,584,585,588],{},[501,582,583],{},"financeline.\u003Cdomain>"," - Microsoft 365 ",[501,586,587],{},"GET \u002FMe.htm?v=3"," (early VoidProxy did not proxy this request)",[498,590,591,584,594],{},[501,592,593],{},"portal.\u003Cdomain>",[501,595,596],{},"GET \u002FPrefetch\u002FPrefetch.aspx",[487,598,600],{"id":599},"network-traffic","Network traffic",[480,602,603,604,607],{},"VoidProxy acts as a reverse proxy with the majority of traffic simply looking the same as a\ngenuine sign-in flow, but through the malicious proxy domain. Some of the request paths are\nrandomised to avoid detection. For example, when phishing Microsoft 365, the sign-in page loads\nfrom a random encoded URL parameter rather than ",[501,605,606],{},"\u002Fcommon\u002Foauth2\u002Fv2.0\u002Fauthorize?client_id=...",".",[609,610,612],"h3",{"id":611},"the-voidproxy-handshake","The VoidProxy handshake",[480,614,615],{},"After passing the anti-bot gate, the client-side JavaScript performs a handshake with the server\nto retrieve the phishing page URL to redirect to. The handshake works by appending a random number\nto a chosen prefix, taking the SHA-256 hash, and sending it to the server for verification. The server\nthen responds with an encoded URL.",[480,617,618,619,622,623,626],{},"In early versions of VoidProxy, the prefix to the hash input was the static 'secret' ",[501,620,621],{},"VoidProxY",".\nThe signed random number was sent as the ",[501,624,625],{},"authvp"," parameter:",[628,629,633],"pre",{"className":630,"code":631,"language":632,"meta":42,"style":42},"language-javascript shiki shiki-themes github-dark-default","let url  = new URL(atob(location.search.split('=').slice(1).join('=')));\nlet rand = Math.floor(Math.random() * 1000000).toString();\nlet sig  = await sha256hex('VoidProxY' + rand);\nlet r    = await fetch(url.origin + '?authvp=' + rand + '-' + sig, { method: 'GET' });\nlet body = await r.text();\n\n\u002F\u002F Decode the redirect URL\nlet decoded = atob(body.split('').reverse().join('').replaceAll('$', '='));\n","javascript",[501,634,635,699,737,764,808,828,835,842],{"__ignoreMap":42},[636,637,639,643,647,650,653,657,660,663,666,669,671,675,678,681,683,687,689,692,694,696],"span",{"class":638,"line":29},"line",[636,640,642],{"class":641},"suJrU","let",[636,644,646],{"class":645},"sZEs4"," url  ",[636,648,649],{"class":641},"=",[636,651,652],{"class":641}," new",[636,654,656],{"class":655},"sc3cj"," URL",[636,658,659],{"class":645},"(",[636,661,662],{"class":655},"atob",[636,664,665],{"class":645},"(location.search.",[636,667,668],{"class":655},"split",[636,670,659],{"class":645},[636,672,674],{"class":673},"s9uIt","'='",[636,676,677],{"class":645},").",[636,679,680],{"class":655},"slice",[636,682,659],{"class":645},[636,684,686],{"class":685},"sFSAA","1",[636,688,677],{"class":645},[636,690,691],{"class":655},"join",[636,693,659],{"class":645},[636,695,674],{"class":673},[636,697,698],{"class":645},")));\n",[636,700,701,703,706,708,711,714,717,720,723,726,729,731,734],{"class":638,"line":46},[636,702,642],{"class":641},[636,704,705],{"class":645}," rand ",[636,707,649],{"class":641},[636,709,710],{"class":645}," Math.",[636,712,713],{"class":655},"floor",[636,715,716],{"class":645},"(Math.",[636,718,719],{"class":655},"random",[636,721,722],{"class":645},"() ",[636,724,725],{"class":641},"*",[636,727,728],{"class":685}," 1000000",[636,730,677],{"class":645},[636,732,733],{"class":655},"toString",[636,735,736],{"class":645},"();\n",[636,738,740,742,745,747,750,753,755,758,761],{"class":638,"line":739},3,[636,741,642],{"class":641},[636,743,744],{"class":645}," sig  ",[636,746,649],{"class":641},[636,748,749],{"class":641}," await",[636,751,752],{"class":655}," sha256hex",[636,754,659],{"class":645},[636,756,757],{"class":673},"'VoidProxY'",[636,759,760],{"class":641}," +",[636,762,763],{"class":645}," rand);\n",[636,765,767,769,772,774,776,779,782,785,788,790,792,794,797,799,802,805],{"class":638,"line":766},4,[636,768,642],{"class":641},[636,770,771],{"class":645}," r    ",[636,773,649],{"class":641},[636,775,749],{"class":641},[636,777,778],{"class":655}," fetch",[636,780,781],{"class":645},"(url.origin ",[636,783,784],{"class":641},"+",[636,786,787],{"class":673}," '?authvp='",[636,789,760],{"class":641},[636,791,705],{"class":645},[636,793,784],{"class":641},[636,795,796],{"class":673}," '-'",[636,798,760],{"class":641},[636,800,801],{"class":645}," sig, { method: ",[636,803,804],{"class":673},"'GET'",[636,806,807],{"class":645}," });\n",[636,809,811,813,816,818,820,823,826],{"class":638,"line":810},5,[636,812,642],{"class":641},[636,814,815],{"class":645}," body ",[636,817,649],{"class":641},[636,819,749],{"class":641},[636,821,822],{"class":645}," r.",[636,824,825],{"class":655},"text",[636,827,736],{"class":645},[636,829,831],{"class":638,"line":830},6,[636,832,834],{"emptyLinePlaceholder":833},true,"\n",[636,836,838],{"class":638,"line":837},7,[636,839,841],{"class":840},"sH3jZ","\u002F\u002F Decode the redirect URL\n",[636,843,845,847,850,852,855,858,860,862,865,867,870,873,875,877,879,881,884,886,889,892,894],{"class":638,"line":844},8,[636,846,642],{"class":641},[636,848,849],{"class":645}," decoded ",[636,851,649],{"class":641},[636,853,854],{"class":655}," atob",[636,856,857],{"class":645},"(body.",[636,859,668],{"class":655},[636,861,659],{"class":645},[636,863,864],{"class":673},"''",[636,866,677],{"class":645},[636,868,869],{"class":655},"reverse",[636,871,872],{"class":645},"().",[636,874,691],{"class":655},[636,876,659],{"class":645},[636,878,864],{"class":673},[636,880,677],{"class":645},[636,882,883],{"class":655},"replaceAll",[636,885,659],{"class":645},[636,887,888],{"class":673},"'$'",[636,890,891],{"class":645},", ",[636,893,674],{"class":673},[636,895,896],{"class":645},"));\n",[480,898,899],{},"In 2026, this handshake was updated to remove the fixed strings. The prefix to the hash input\nis now derived from the URL of the landing page. The same value is also used as the URL parameter\nthat the signed random number is sent in:",[628,901,903],{"className":630,"code":902,"language":632,"meta":42,"style":42},"const url  = new URL(location.href);\nconst rand = Math.floor(Math.random() * 1000000).toString();\n\n\u002F\u002F Secret = first path segment, else the first query-parameter name\nconst name = (url.pathname !== '\u002F' ? url.pathname.substring(1)\n                                    : url.searchParams.keys().next().value || '');\n\nconst sig  = await sha256hex(name + rand);\nconst res  = await fetch(url.origin + '?' + name + '1=' + rand + '-' + sig)\n",[501,904,905,923,953,957,962,996,1024,1028,1048],{"__ignoreMap":42},[636,906,907,910,913,916,918,920],{"class":638,"line":29},[636,908,909],{"class":641},"const",[636,911,912],{"class":685}," url",[636,914,915],{"class":641},"  =",[636,917,652],{"class":641},[636,919,656],{"class":655},[636,921,922],{"class":645},"(location.href);\n",[636,924,925,927,930,933,935,937,939,941,943,945,947,949,951],{"class":638,"line":46},[636,926,909],{"class":641},[636,928,929],{"class":685}," rand",[636,931,932],{"class":641}," =",[636,934,710],{"class":645},[636,936,713],{"class":655},[636,938,716],{"class":645},[636,940,719],{"class":655},[636,942,722],{"class":645},[636,944,725],{"class":641},[636,946,728],{"class":685},[636,948,677],{"class":645},[636,950,733],{"class":655},[636,952,736],{"class":645},[636,954,955],{"class":638,"line":739},[636,956,834],{"emptyLinePlaceholder":833},[636,958,959],{"class":638,"line":766},[636,960,961],{"class":840},"\u002F\u002F Secret = first path segment, else the first query-parameter name\n",[636,963,964,966,969,971,974,977,980,983,986,989,991,993],{"class":638,"line":810},[636,965,909],{"class":641},[636,967,968],{"class":685}," name",[636,970,932],{"class":641},[636,972,973],{"class":645}," (url.pathname ",[636,975,976],{"class":641},"!==",[636,978,979],{"class":673}," '\u002F'",[636,981,982],{"class":641}," ?",[636,984,985],{"class":645}," url.pathname.",[636,987,988],{"class":655},"substring",[636,990,659],{"class":645},[636,992,686],{"class":685},[636,994,995],{"class":645},")\n",[636,997,998,1001,1004,1007,1009,1012,1015,1018,1021],{"class":638,"line":830},[636,999,1000],{"class":641},"                                    :",[636,1002,1003],{"class":645}," url.searchParams.",[636,1005,1006],{"class":655},"keys",[636,1008,872],{"class":645},[636,1010,1011],{"class":655},"next",[636,1013,1014],{"class":645},"().value ",[636,1016,1017],{"class":641},"||",[636,1019,1020],{"class":673}," ''",[636,1022,1023],{"class":645},");\n",[636,1025,1026],{"class":638,"line":837},[636,1027,834],{"emptyLinePlaceholder":833},[636,1029,1030,1032,1035,1037,1039,1041,1044,1046],{"class":638,"line":844},[636,1031,909],{"class":641},[636,1033,1034],{"class":685}," sig",[636,1036,915],{"class":641},[636,1038,749],{"class":641},[636,1040,752],{"class":655},[636,1042,1043],{"class":645},"(name ",[636,1045,784],{"class":641},[636,1047,763],{"class":645},[636,1049,1051,1053,1056,1058,1060,1062,1064,1066,1069,1071,1074,1076,1079,1081,1083,1085,1087,1089],{"class":638,"line":1050},9,[636,1052,909],{"class":641},[636,1054,1055],{"class":685}," res",[636,1057,915],{"class":641},[636,1059,749],{"class":641},[636,1061,778],{"class":655},[636,1063,781],{"class":645},[636,1065,784],{"class":641},[636,1067,1068],{"class":673}," '?'",[636,1070,760],{"class":641},[636,1072,1073],{"class":645}," name ",[636,1075,784],{"class":641},[636,1077,1078],{"class":673}," '1='",[636,1080,760],{"class":641},[636,1082,705],{"class":645},[636,1084,784],{"class":641},[636,1086,796],{"class":673},[636,1088,760],{"class":641},[636,1090,1091],{"class":645}," sig)\n",[1093,1094,1095],"style",{},"html pre.shiki code .suJrU, html code.shiki .suJrU{--shiki-default:#FF7B72}html pre.shiki code .sZEs4, html code.shiki .sZEs4{--shiki-default:#E6EDF3}html pre.shiki code .sc3cj, html code.shiki .sc3cj{--shiki-default:#D2A8FF}html pre.shiki code .s9uIt, html code.shiki .s9uIt{--shiki-default:#A5D6FF}html pre.shiki code .sFSAA, html code.shiki .sFSAA{--shiki-default:#79C0FF}html pre.shiki code .sH3jZ, html code.shiki .sH3jZ{--shiki-default:#8B949E}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":42,"searchDepth":739,"depth":739,"links":1097},[1098,1099],{"id":489,"depth":46,"text":490},{"id":599,"depth":46,"text":600,"children":1100},[1101],{"id":611,"depth":739,"text":612},"md","2026-10",{},"VoidProxy","\u002Fthreat-intel\u002Fvoidproxy\u002Fpublic",[1108],{"url":1109,"title":1110,"publisher":1111},"https:\u002F\u002Fwww.okta.com\u002Fblog\u002Fthreat-intelligence\u002Funcloaking-void-proxy\u002F","Uncloaking VoidProxy: a novel and evasive Phishing-as-a-Service framework","Okta",[1113,1119,1123,1128],{"date":1114,"urlscan":1115,"scheme":1116,"host":1117,"rest":1118},"2025-08-27","https:\u002F\u002Furlscan.io\u002Fresult\u002F0198eb35-536e-746d-a1a2-426ad4c16872","hxxps:\u002F\u002F","accounts[.]apyohg[.]icu","\u002F",{"date":1120,"urlscan":1121,"scheme":1116,"host":1122,"rest":1118},"2025-09-25","https:\u002F\u002Furlscan.io\u002Fresult\u002F01998215-da39-74aa-a060-1c2b60245ec9","login[.]preventgrouq[.]com",{"date":1124,"urlscan":1125,"scheme":1116,"host":1126,"rest":1127},"2026-07-31","https:\u002F\u002Furlscan.io\u002Fresult\u002F019fb9ef-d456-75ae-83f3-a89d9268f0ff","login[.]400captal[.]com","\u002F?JZYZ_vsc=eGJodGJqZA==",{"date":1129,"urlscan":1130,"scheme":1116,"host":1131,"rest":1132},"2026-09-03","https:\u002F\u002Furlscan.io\u002Fresult\u002F01a066e2-cd48-7789-bb9c-04ff232adb06","accounts[.]euigrxf[.]icu","\u002F?kwo8K78=eHNocQ==",{"description":482},"voidproxy\u002Fpublic",[1136],"aitm",[1138,1139,1140],"Google","Microsoft","Apple iCloud",[1142],"credential_phishing",{"2026-06":1144,"2026-07":1145,"2026-08":1145,"2026-09":1146},"moderate","high","extreme","phishing","DTi9-8Ef3hHEgYIVr7tSylK1sDtk2oji4l3gMkssqfs",{"taxonomy":1150,"share":1191,"breakthroughRate":1201,"leaderboard":1223,"ratings":1256,"faqs":1274},{"techniques":1151,"subTechniques":1174},[1152,1157,1163,1169],{"id":1142,"label":1153,"aka":1154,"description":1155,"hex":1156},"Credential phishing","MFA-bypass phishing, AiTM, BitM, BitB","MFA-bypassing phishing techniques that enable attackers to capture the password, the MFA code and the resulting session cookie.","#8FB7D9",{"id":1158,"label":1159,"aka":1160,"description":1161,"hex":1162},"authorization_phishing","Authorization phishing","device code phishing, consent phishing, ConsentFix","Phishing techniques that land post-authentication and trick the victim into granting authorization for an attacker to access their account, circumventing the login and MFA altogether (including passkeys).","#A9D18E",{"id":1164,"label":1165,"aka":1166,"description":1167,"hex":1168},"malicious_copy_paste","Malicious copy & paste","ClickFix, InstallFix, FileFix","The victim is tricked into copying a command from a fake error, CAPTCHA or \"fix\" page and pasting it into a terminal or Run dialog, executing malware themselves.","#AA95FF",{"id":1170,"label":1171,"aka":33,"description":1172,"hex":1173},"other","Other","Other includes blocked file downloads and miscellaneous items detected through custom detections.","#6FBF8F",[1175,1179,1184,1187],{"id":1136,"technique":1142,"label":1176,"short":1177,"description":1178},"Adversary-in-the-middle (AitM)","AitM","Proxies the user's inputs to the real sign-in page and intercepts credentials, MFA codes and the resulting session cookie.",{"id":1180,"technique":1142,"label":1181,"short":1182,"description":1183},"bitm","Browser-in-the-middle (BitM)","BitM","Uses desktop streaming software like noVNC to stream a remote browser into the victim's tab, so they log in to the genuine sign-in page for Microsoft, Google or another app on the attacker's device.",{"id":1185,"technique":1158,"label":141,"short":141,"description":1186},"device_code_phishing","The victim is tricked into entering an attacker-provided authorization code into the real device-code login page for an app, granting the attacker access to their account.",{"id":1188,"technique":1164,"label":1189,"short":1190,"description":1167},"clickfix","ClickFix (malicious copy & paste)","ClickFix",{"asOf":1192,"windowMonths":739,"rows":1193},"2026-08",[1194,1196,1198,1200],{"id":1164,"label":1165,"aka":1166,"description":1167,"hex":1168,"pct":1195},50,{"id":1142,"label":1153,"aka":1154,"description":1155,"hex":1156,"pct":1197},32,{"id":1158,"label":1159,"aka":1160,"description":1161,"hex":1162,"pct":1199},10,{"id":1170,"label":1171,"aka":33,"description":1172,"hex":1173,"pct":844},{"unit":1202,"series":1203},"attacks per 10,000 employees per month",[1204,1209,1214,1218],{"key":1205,"label":1206,"short":1207,"value":1208},"2026-06","Jun 2026","Jun",22,{"key":1210,"label":1211,"short":1212,"value":1213},"2026-07","Jul 2026","Jul",21,{"key":1192,"label":1215,"short":1216,"value":1217},"Aug 2026","Aug",41,{"key":1219,"label":1220,"short":1221,"value":1222},"2026-09","Sep 2026","Sep",33,[1224,1234,1240,1245,1248,1252,1254],{"key":1225,"label":1226,"short":1227,"slugs":1228},"2026-03","Mar 2026","Mar",[1229,1230,1231,1232,1233],"eviltokens","sneaky-2fa","flowerstorm","kali365","redlogin",{"key":1235,"label":1236,"short":1237,"slugs":1238},"2026-04","Apr 2026","Apr",[1230,1232,1231,1229,1239],"tycoon-2fa",{"key":1241,"label":1242,"short":1243,"slugs":1244},"2026-05","May 2026","May",[1232,1239,1229,1230,1233],{"key":1205,"label":1206,"short":1207,"slugs":1246},[1230,1229,1239,1247,1233],"xxevite",{"key":1210,"label":1211,"short":1212,"slugs":1249},[1230,1250,1229,1251,1233],"domdiffer","voidproxy",{"key":1192,"label":1215,"short":1216,"slugs":1253},[1250,1230,1229,1247,1232],{"key":1219,"label":1220,"short":1221,"slugs":1255},[1250,1251,1247,1233,1232],[1257,1260,1263,1266,1270],{"id":1146,"label":1258,"definition":1259},"Extreme","The tool is reaching users at the highest rate Push observes. Expect multiple attacks per month to break through to employees in a typical organization.",{"id":1145,"label":1261,"definition":1262},"High","The tool reaches users regularly. Attacks break through most months in a typical organization.",{"id":1144,"label":1264,"definition":1265},"Moderate","The tool reaches users at a steady but lower rate. Attacks break through intermittently rather than every month.",{"id":1267,"label":1268,"definition":1269},"emerging","Emerging","The tool has only recently started reaching users, or does so rarely. Too little history to establish a trend.",{"id":1271,"label":1272,"definition":1273},"inactive","Inactive","Push has not seen the tool reach a user this month. It remains tracked because tools often return after a pause.",[1275,1278,1281,1284],{"question":1276,"answer":1277},"What IoCs do you provide?","Each tool profile documents the patterns, behaviors and implementation details that identify it. We believe that this provides greater value than long lists of hostnames and IP addresses. However, we do also link to representative samples on urlscan.io, which include example domains and payloads.",{"question":1279,"answer":1280},"Do you supply a feed of malicious domains?","No. Attackers rotate phishing domains so quickly that a feed of past detections has little blocking value. Instead, we want to help researchers, incident responders and analysts identify the most prevalent browser attack tools and understand how they work.",{"question":1282,"answer":1283},"How are you naming the tools?","Tools are given their public kit name if known, but we identify many kits in our detections that have no public attribution. Some names are therefore internal codenames we use to track the kits. If you think one maps to a public kit, let us know.",{"question":1285,"answer":1286},"Can I submit my own domains?","Not yet. Push customers can contact us to check whether a URL matches a known tool.",[1288,1311,1317,1327],{"technique":1289,"subTechnique":1290,"tools":1291},{"id":1142,"label":1153,"aka":1154,"description":1155,"hex":1156},{"id":1136,"short":1177},[1292,1294,1296,1299,1302,1304,1306,1308,1309],{"slug":1250,"name":1293,"level":1146},"DOMDIFFER",{"slug":1231,"name":1295,"level":1144},"FlowerStorm",{"slug":1297,"name":1298,"level":1144},"greatness","Greatness",{"slug":1300,"name":1301,"level":1144},"nakedpages","NakedPages",{"slug":1233,"name":1303,"level":1145},"RedLogin",{"slug":1230,"name":1305,"level":1144},"Sneaky 2FA",{"slug":1239,"name":1307,"level":1271},"Tycoon 2FA",{"slug":1251,"name":1105,"level":1146},{"slug":1247,"name":1310,"level":1146},"XXEVITE",{"technique":1289,"subTechnique":1312,"tools":1313},{"id":1180,"short":1182},[1314],{"slug":1315,"name":1316,"level":1144},"laurseraph","Laurseraph",{"technique":1318,"subTechnique":1319,"tools":1320},{"id":1158,"label":1159,"aka":1160,"description":1161,"hex":1162},{"id":1185,"short":141},[1321,1323,1324,1326],{"slug":1229,"name":1322,"level":1144},"EvilTokens",{"slug":1297,"name":1298,"level":1144},{"slug":1232,"name":1325,"level":1145},"Kali365",{"slug":1239,"name":1307,"level":1271},{"technique":1328,"subTechnique":1329,"tools":1330},{"id":1164,"label":1165,"aka":1166,"description":1167,"hex":1168},{"id":1188,"short":1190},[1331,1334,1337],{"slug":1332,"name":1333,"level":1146},"errtraffic","ErrTraffic",{"slug":1335,"name":1336,"level":1145},"nochain","NOCHAIN",{"slug":1338,"name":1339,"level":1145},"turntip","TURNTIP",1793113270495]