GhostFrame
GhostFrame is a phishing-as-a-service (PhaaS) phishing kit tracked since September 2025. It is described as a stealth-focused kit that has powered more than a million phishing attacks. GhostFrame emphasizes obfuscation and URL concealment, hiding malicious activity inside iframes loaded from constantly changing subdomains. It uses a two-stage iframe architecture, dynamically generates a unique random subdomain for each victim, and can rotate subdomains during an active session to evade domain-based detection and blocking. The kit validates visitors before loading pages and delivers phishing forms through blob-based image streaming, including hiding sign-in forms inside image-streaming or large-file-handler features to evade static analysis and content scanners. Reported anti-analysis behavior includes disabling right-click, blocking keyboard shortcuts, and interfering with browser developer tools. It can spoof legitimate services by changing page titles and favicons to match impersonated brands, including making fake login screens appear as legitimate Microsoft 365 login pages. The content identifies GhostFrame as part of the broader 2025 rise in sophisticated PhaaS kits used to conduct large-scale phishing campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Phishing kit used for credential theft at scale (details not expanded in provided text).
A stealth-oriented phishing kit using advanced obfuscation, URL concealment, and blob-based image streaming to evade detection and static analysis.
GhostFrame is a sophisticated phishing-as-a-service kit that leverages dynamic iframes and subdomain rotation to evade detection. It enables attackers to spoof legitimate services, hide phishing forms within non-obvious web features, and employs anti-analysis techniques to hinder investigation. Its innovation allows less-skilled cybercriminals to conduct large-scale, evasive phishing campaigns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.