Loading malware…
Starkiller is a phishing-as-a-service adversary-in-the-middle framework associated with the Jinkusu operation. It is designed to proxy legitimate login pages through attacker-controlled infrastructure in real time, allowing operators to steal credentials, one-time passcodes, session cookies, and authentication tokens and thereby bypass multi-factor authentication protections. Rather than relying on static cloned templates, Starkiller loads the genuine target site in a headless browser running inside a Docker container and relays victim interactions through a reverse proxy, which keeps the phishing experience visually current and reduces artifacts that defenders can fingerprint or blocklist.
The platform is marketed and operated like a subscription service, with centralized dashboards for brand selection, phishing page deployment, infrastructure management, and active session monitoring. Reported impersonation targets include major consumer and enterprise brands such as Microsoft, Google, Apple, Facebook, Amazon, Netflix, PayPal, and banking institutions. Starkiller also supports deceptive URL generation and masking, including use of URL shorteners and lookalike link construction, to increase click-through and hinder detection.
Its primary operational value is session-aware compromise: victims authenticate to the real service through the attacker’s proxy, enabling capture of valid post-authentication material in addition to usernames and passwords. This makes Starkiller effective against organizations that rely on conventional MFA methods but do not enforce phishing-resistant authentication. The framework lowers the technical barrier for less skilled operators by abstracting reverse-proxy setup, container orchestration, and related infrastructure tasks into a turnkey interface.
Starkiller has been described both as a modern AiTM phishing suite and, separately in unrelated contexts, as the graphical front end for PowerShell Empire. The phishing framework usage is the clearly supported malware-related meaning here. It targets web-based account access rather than a specific industry, but its impersonation breadth makes it relevant to enterprises, financial institutions, and consumer-facing online services.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Starkiller (operated by a group called Jinkusu) is a newer AiTM-as-a-service with a subscription dashboard, further demonstrating how commoditised the technique now is.
From November 8th to December 11th, Censys captured a Starkiller login panel on port 1337. Starkiller is the front-end for PowerShell Empire, an open-source post-exploitation framework.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Bad actors are using phishing kits to industrialize attacks on consumers, partners, and employees and exploit brand equity and trust.
"a new phishing suite named Starkiller has emerged, designed to circumvent multi-factor authentication (MFA) by proxying legitimate login pages... launching a headless Chrome browser within a Docker container, acting as a reverse proxy between the target and the genuine website."
GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.
Microsoft sets a valid session cookie and the attacker quietly keeps a copy of that cookie. The user sees their real mailbox or Teams, while the attacker opens the same session somewhere else.
There are no template files for vendors to blocklist because it proxies the brand’s real website. And because the end user authenticates with the real site through the proxy, the attacker can capture any one-time codes or authentication tokens the victim submits so they have authenticated access to the account.
“Since the framework proxies legitimate login pages in real time, recipients who click these links are presented with authentic website content rather than static replicas…”
GS7 targeted Fortune 500 financial services, technology, healthcare, and telecom firms worldwide to harvest credentials.
There are no template files for vendors to blocklist because it proxies the brand’s real website. And because the end user authenticates with the real site through the proxy, the attacker can capture any one-time codes or authentication tokens the victim submits so they have authenticated access to the account.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A commercial-grade phishing kit mentioned for comparison as another kit noted for evasion and MFA bypass capabilities.
A phishing kit that proxies legitimate websites through attacker-controlled infrastructure to capture credentials, one-time codes, and authentication tokens, enabling MFA bypass.
A newer AiTM-as-a-service platform with a subscription dashboard used for phishing and session theft.
Open-source post-exploitation framework interface observed exposed on infrastructure associated with TeamPCP. The content does not describe payload behavior beyond identifying it as the front-end for PowerShell Empire.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.