Loading story…
Security researchers reported a new phishing-as-a-service (PhaaS) platform, Starkiller, that defeats many common anti-phishing controls by live-proxying victims to the legitimate login pages of targeted brands while relaying traffic through attacker infrastructure. Instead of serving a static fake page, Starkiller dynamically loads the real site and captures what the user enters—username, password, and multi-factor authentication (MFA) codes—then forwards those inputs to the legitimate service and returns responses to the victim, enabling real-time session takeover.
Reporting based on Abnormal AI’s analysis describes Starkiller as a polished, SaaS-like offering with a dashboard, campaign analytics, and regular updates, lowering the technical barrier for running advanced adversary-in-the-middle phishing. The service supports brand selection (e.g., Microsoft, Google, Apple, Facebook) and uses deceptive link techniques such as embedding a trusted-looking domain before an @ (e.g., login.microsoft.com@...)—where the portion before @ is treated as username data and the actual destination is what follows—often combined with URL shorteners to increase click-through and evade user scrutiny.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Later reporting said Starkiller also targets platforms including Apple and Facebook and may include modules for financial fraud, such as theft of credit card data and cryptocurrency wallet recovery phrases. This expanded the public understanding of the framework beyond basic credential harvesting and session hijacking.
Subsequent coverage attributed Starkiller to a threat group or operation calling itself Jinkusu, which was described as selling the service and related add-on capabilities through a criminal ecosystem. Reports said the offering included features such as session monitoring, credential alerts, and harvesting of additional contact or account data from compromised sessions.
Public reporting described Starkiller as a phishing-as-a-service platform that uses an adversary-in-the-middle reverse proxy to capture credentials, MFA inputs, and session tokens in real time, enabling account takeover even when MFA is completed successfully. The reporting also noted operational features such as containerized browser sessions, deceptive URL masking, and real-time monitoring of victim sessions.
Abnormal AI disclosed Starkiller as a phishing framework that proxies real login pages through attacker-controlled infrastructure, centralizes campaign operations in a control panel, and supports impersonation of major brands such as Microsoft and Google. The research highlighted how the framework lowers the barrier to running large-scale credential and session theft campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcekrebsonsecurity.com
Open sourcedarkreading.com
Open sourceabnormal.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Starkiller**, a phishing-as-a-service suite advertised by a group calling itself **Jinkusu** that uses an **adversary-in-the-middle (AiTM) reverse proxy** to bypass multi-factor authentication by relaying victims to *live* legitimate login pages while capturing credentials and session tokens for account takeover. The tooling reportedly runs a headless Chrome instance inside a **Docker** container to load the real target site and proxy traffic end-to-end, reducing the need for static phishing templates and making fingerprinting/blocklisting harder; it also provides an operator dashboard to select brands/URLs to impersonate, supports lure keyword customization (e.g., “login,” “verify,” “security,” “account”), and integrates URL shorteners (e.g., *TinyURL*) to mask destinations. Separate reporting described a targeted AiTM intrusion attempt that used multiple redirect hops and an **ASP.NET Core** reverse proxy in front of Microsoft 365 login pages, but the author could not attribute it to any known commercial kit based on published AiTM “cheat sheets,” highlighting ongoing evolution and diversification of reverse-proxy phishing stacks beyond commonly documented PHP/Node/Go/Python implementations. Other items in the set cover unrelated malware and threat activity (Android trojans, an Iraq-focused APT campaign, an APT42 PowerShell backdoor, malvertising redirect mechanics, and scam-infrastructure/supply-chain activity) and do not materially add to the Starkiller AiTM disclosure.
Jun 29, 2026
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026