The SharePoint email arrives at 4:47 PM on a Thursday. The sender address reads sharepointadmin at your own firm’s domain. The subject line references a matter number only you and your client should recognize. The body contains a QR code and nothing else, the kind of thin notification that has become routine inside a Microsoft 365 tenant. You scan the code on your phone. You enter your password. You tap “Approve” on the Authenticator prompt. The login succeeds. So does the attacker’s. On April 9, 2026, the cybersecurity firm Abnormal AI published research documenting a previously undisclosed phishing-as-a-service platform called VENOM. Between November 2025 and March 2026, VENOM operators ran a credential-theft campaign against CEOs, CFOs, chairmen, and vice presidents across more than twenty industry verticals. Sixty percent of the targets were C-level or above. The lure in every case was a SharePoint document-share notification, personalized by name, matter, and internal email thread. VENOM does two things most attorneys assume cannot be done. First, it runs an adversary-in-the-middle proxy that sits between the target and Microsoft’s real login page. When the partner enters her password and approves the MFA prompt, VENOM captures both and relays them to Microsoft in real time. The login looks legitimate because it is legitimate; the attacker rides it. Second, VENOM captures the session token Microsoft issues at the end of that exchange. That token keeps the partner logged in for hours or days. It does not require the password. It does not require the MFA prompt. A password reset the next morning will not invalidate it. In a parallel variant, VENOM prompts the target through Microsoft’s device-code authentication flow, tricking the partner into approving a login request that actually registers the attacker’s device on her account. Once registered, that device persists through password changes, session expirations, and standard incident-response workflows. The attacker no longer needs to phish the partner again. The door is already open. **The Partner Exception Problem** Most firms treat senior partners as exceptions to the security stack associates and staff live under. The managing partner does not get a FIDO2 hardware key because it would be inconvenient during depositions. She uses the Authenticator app because hardware tokens “get lost.” Her account has conditional access exceptions because her assistant logs in from a different device. Every one of these accommodations makes VENOM’s job easier. The partner’s inbox also holds the highest-value material in the building: privileged attorney-client communications, sealed filings, unexecuted settlement drafts, and the wire instructions for every closing her firm has touched this year. That last item matters because credential theft at a managing partner is not the end of the attack. It is the platform for the next one. An attacker sitting in a partner’s mailbox can time a fraudulent wire instruction to arrive in a client’s inbox one hour before the scheduled funding call, using the partner’s actual signature block and the actual closing documents. The client sees an email from her trusted lawyer, referencing the actual matter, with updated wire details. She wires the funds. [See The Voice on the Phone Was Not Your Client, The Technology Blind Spot (2026).] **The Steelman** A competent IT vendor will tell you the firm is already protected. Email filtering catches the overwhelming majority of phishing. MFA blocks credential replay. Endpoint detection flags suspicious logins from new geographies. All of that is true for commodity attacks. VENOM is not a commodity attack. The emails randomize their HTML structure on every send to defeat signature-based filters. The QR code forces the attack onto the partner’s mobile phone, where the firm’s endpoint controls likely do not apply. The credential capture happens inside a real Microsoft login flow, so the flow itself looks clean to any control watching for anomalous authentication. And because the session token is legitimate, the persistent access that follows does not register as an intrusion on any dashboard. **A Source Caveat** One caveat applies. Abnormal AI is, as of this writing, the only organization that has documented the VENOM platform; no independent confirmation from CISA, Microsoft’s Security Response Center, Mandiant, or the FBI has yet appeared. Vendor research with a sales motive deserves skepticism. But researchers have documented the same underlying techniques (adversary-in-the-middle proxies, device-code phishing, OAuth token capture) in prior unrelated campaigns going back several years. The novelty here is the packaging, not the technique. Waiting for third-party confirmation before acting is a reasonable instinct. It is also how firms end up briefing their insurance carrier instead of their client. **What Catherine Does Thursday** Pick up the phone and call your managed services provider or internal IT lead. Ask two questions. First, whether IT has deployed FIDO2 hardware security keys on every partner and administrative account in the firm, and if not, what the timeline and the blocker are. FIDO2 is the single control that defeats adversary-in-the-middle phishing, because the authentication is cryptographically bound to the actual domain the browser is talking to. A spoofed Microsoft login page cannot complete a FIDO2 handshake. It is the only control on the list that currently matters against VENOM. Second, whether the firm has disabled device-code authentication flow on its Microsoft 365 tenant, and if still enabled, which business function justifies it. For most small and mid-sized firms, the answer is none. Device-code flow exists for legacy devices that cannot render a browser login. If the firm does not run such devices, disable the feature at the tenant level. **If your IT vendor cannot answer either question inside of an hour, that is your answer.** **Close** The 4:47 PM SharePoint email did not look like phishing because no one designed it to look like phishing. Someone designed it to look like Thursday afternoon inside a law firm. The partner scanned the code on her phone because partners scan codes on their phones. She entered her password because passwords are how she logs in. She approved the MFA prompt because training tells her to approve MFA prompts. Everything worked exactly as it was supposed to work, for her and for the person who now has a registered device on her account, sitting there next to the client files, waiting for Monday. **About the Author** JD Morris is Co-Founder and COO of LexAxiom, an Agentic AI platform for the business of law. Over a 25-year career, he has built and scaled enterprise technology products across Dell, EMC, VMware, and Cisco, including the first exabyte eDiscovery platform. He holds dual MBAs from Columbia Business School (Finance) and UC Berkeley Haas (Marketing), a Master of Legal Studies in Cybersecurity Law from Texas A&M, and a Master of Engineering from George Washington University. He writes The Technology Blind Spot on the intersection of emerging technology and law. Connect with him on LinkedIn at http://www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social. **References** 1. Abnormal AI, Exposing VENOM: Exec-Targeted Phishing Campaign and the Platform Powering It, Abnormal AI (Apr. 2026), https://abnormal.ai/resources/venom-phaas-c-suite-microsoft-credential-theft-report. 2. Bill Toulas, New VENOM Phishing Attacks Steal Senior Executives’ Microsoft Logins, BleepingComputer (Apr. 9, 2026), https://www.bleepingcomputer.com/news/security/new-venom-phishing-attacks-steal-senior-executives-microsoft-logins/. 3. New Phishing Platform Used in Credential Theft Campaigns, Infosecurity Mag. (Apr. 2026), https://www.infosecurity-magazine.com/news/new-phishing-platform-credential/. 4. Highly Evasive Spear-Phishing Campaign Targeting Senior Execs ‘Neutralizes’ MFA, SC Media (Apr. 2026), https://www.scworld.com/news/highly-evasive-spear-phishing-campaign-targeting-senior-execs-neutralizes-mfa. 5. Microsoft, Passkeys and FIDO2 Security Keys in Microsoft Entra ID, Microsoft Learn (2026). 6. Microsoft, Device Code Flow in the Microsoft Identity Platform, Microsoft Learn (2026). 7. JD Morris, The Voice on the Phone Was Not Your Client, The Technology Blind Spot (Feb. 2026).

Originally published on LinkedIn Newsletter: The Technology Blind Spot