H-ISAC TLP White Threat Bulletin VoidProxy: A New and Evasive Phishing-as-a-Service Framework

On September 11, 2025, Okta discovered a sophisticated Phishing-as-a-Service framework named VoidProxy. Due to its evasive capabilities and modular design, it has emerged as a significant threat. Cybercriminals use it to conduct Adversary-in-the-Middle (AitM) phishing attacks, which allow them to intercept and manipulate communications between users and legitimate services. The attacks target Microsoft and Google accounts and can redirect accounts secured by identity providers, such as Okta, to malicious websites.

As phishing remains one of the most common attack vectors for the health sector, Health-ISAC is providing this information to increase situational awareness and share details about the recent Phishing-as-a-Service framework, its security implications, and recommendations for defending against malicious activity.

View the detailed report below.