Tag: phishing-as-a-service

13 Attack Reports | 0 Vulnerabilities

Attack reports

Bluekit Phishing as a Service (PhaaS)

BlueKit operates as a mature commercial Phishing-as-a-Service platform offering 87 ready-made phishing kits targeting banks, cloud services, cryptocurrency exchanges, and global brands. The platform features subscription-based access, automated account takeover capabilities, peer-to-peer infrastruc…
phishing-as-a-service
credential-harvesting
cryptocurrency-theft
session-hijacking
2026-06-16
account-takeover
anti-detection
automated-workflows
peer-to-peer-infrastructure
Published: June 16, 2026
Downloadable IOCs: 0

Sniper's Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud

An investigation into phishing activity targeting users across the Middle East and North Africa uncovered SniperDz, a centralized Push-Notification-as-a-Service and Phishing-as-a-Service platform. The operation uses fraudulent Facebook accounts impersonating politicians, public figures, and trusted…
phishing-as-a-service
browser hijacking
2026-06-11
sniperdz
Published: June 11, 2026
Downloadable IOCs: 2

PHISH ALERT: Press Play for Compromise — Voicemail Phishing Kit Bundles SSO Hijacking, Credential Theft, and RMM Delivery

An advanced voicemail-themed phishing campaign is utilizing HTML attachments to hijack Microsoft 365 sessions through silent OAuth exploitation. Emails arrive spoofing legitimate businesses with fake voicemail notifications containing embedded HTML files. When victims click the play button, the kit…
credential harvesting
microsoft 365
phishing-as-a-service
2026-06-10
oauth hijacking
sso exploitation
voicemail phishing
Published: June 10, 2026
Downloadable IOCs: 19

Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunicatio…
smishing
brand impersonation
credit card theft
phishing-as-a-service
2026-06-03
mobile targeting
Published: June 3, 2026
Downloadable IOCs: 7

From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services

A significant expansion of the Kali365 phishing-as-a-service operation has been observed, now targeting multiple platforms beyond Microsoft 365. The operator abuses OAuth 2.0 device authorization flows to bypass MFA and steal authentication tokens. Key discoveries include a live command-and-control…
mfa bypass
phishing-as-a-service
token theft
device code phishing
kali365
ekz infostealer
2026-06-02
max messenger
oauth 2.0 abuse
russian platforms
Published: June 2, 2026
Downloadable IOCs: 1

The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

Researchers uncovered a massive fraud ecosystem targeting the 2026 FIFA World Cup, identifying over 4,300 fraudulent domains impersonating FIFA's official website since August 2025. At the center operates GHOST STADIUM, a Chinese-speaking threat actor running a sophisticated phishing campaign acros…
credential phishing
phishing-as-a-service
cryptocurrency fraud
2026-05-27
facebook advertising exploitation
fifa world cup 2026
ghost stadium
ticket fraud
Published: May 27, 2026
Downloadable IOCs: 19

Device Code Phishing is an Evolution in Identity Takeover

Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization gr…
credential theft
clickfix
microsoft 365
phishing-as-a-service
account takeover
tycoon 2fa
identity compromise
device code phishing
eviltokens
kali365
oauth abuse
2026-05-14
artokens
odx
Published: May 14, 2026
Downloadable IOCs: 0

Token Bingo: Don't Let Your Code be the Winner

In early April 2026, a large-scale device code phishing campaign targeted organizations across multiple sectors and regions, exploiting OAuth 2.0 Device Authorization Grant. Threat actors leveraged the Kali365 phishing-as-a-service platform, originating primarily from IP address 216.203.20[.]95. Th…
credential theft
microsoft 365
phishing-as-a-service
inbox rules
token theft
device code phishing
2026-04-25
kali365
oauth abuse
Published: April 25, 2026
Downloadable IOCs: 5

REFUNDEE: Inside a Shadow Panel Phishing-as-a-Service Operation

An open directory discovery at refundonex[.]com exposed a complete Phishing-as-a-Service and RAT-as-a-Service platform targeting Spanish and Portuguese-speaking victims. The investigation uncovered 3,788 files including weaponized LNK, VBS, and AES-encrypted PowerShell payloads delivering a remote …
powershell
webdav
phishing-as-a-service
2026-04-13
rat-as-a-service
bulgarian-infrastructure
cryptocurrency-theft
refundee
shadow panel
shadow-panel
spanish-portuguese-targeting
Published: April 13, 2026
Downloadable IOCs: 17

New widespread EvilTokens kit: device code phishing as-a-service

EvilTokens is a new Phishing-as-a-Service offering a turnkey Microsoft device code phishing kit. It enables attackers to harvest access and refresh tokens, granting unauthorized access to victims' Microsoft accounts. The kit supports post-compromise operations, allowing data exfiltration from vario…
microsoft 365
business email compromise
phishing-as-a-service
account takeover
2026-03-31
device code phishing
eviltokens
oauth 2.0
token harvesting
Published: March 31, 2026
Downloadable IOCs: 0

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Tycoon2FA emerged as a prominent phishing-as-a-service platform in August 2023, enabling large-scale campaigns targeting over 500,000 organizations monthly. Developed by Storm-1747, it provided adversary-in-the-middle capabilities to bypass multifactor authentication. The kit allowed impersonation …
credential theft
adversary-in-the-middle
evasion techniques
phishing-as-a-service
tycoon2fa
2026-03-04
multifactor authentication bypass
session token interception
Published: March 4, 2026
Downloadable IOCs: 9

PhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec's Operations

This analysis explores the connections between two Phishing-as-a-Service (PhaaS) platforms: Tycoon2FA and Dadsec. The investigation reveals shared infrastructure and operational similarities, suggesting a common origin or adaptation. The report details the evolving tactics of Tycoon2FA, including i…
aitm
credential theft
mfa bypass
phishing-as-a-service
dadsec
tycoon2fa
2025-05-29
Published: May 29, 2025
Downloadable IOCs: 0

Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)

This analysis explores the Rockstar 2FA phishing-as-a-service kit, focusing on real-world email campaign examples. It highlights various techniques used by attackers, including the abuse of legitimate services for FUD (Fully Undetectable) links, such as Microsoft OneDrive, OneNote, Dynamics 365, At…
phishing
aitm
email campaigns
microsoft 365
2024-12-03
phishing-as-a-service
dadsec
rockstar 2fa
2024-12-04
rockstar
Published: December 4, 2024
Downloadable IOCs: 51
Click here to see more Attack Reports