Starkiller Phishing-as-a-Service Uses Live Proxying to Capture Credentials and MFA Codes
Security researchers reported a new phishing-as-a-service (PhaaS) platform, Starkiller, that defeats many common anti-phishing controls by live-proxying victims to the legitimate login pages of targeted brands while relaying traffic through attacker infrastructure. Instead of serving a static fake page, Starkiller dynamically loads the real site and captures what the user enters—username, password, and multi-factor authentication (MFA) codes—then forwards those inputs to the legitimate service and returns responses to the victim, enabling real-time session takeover.
Reporting based on Abnormal AI’s analysis describes Starkiller as a polished, SaaS-like offering with a dashboard, campaign analytics, and regular updates, lowering the technical barrier for running advanced adversary-in-the-middle phishing. The service supports brand selection (e.g., Microsoft, Google, Apple, Facebook) and uses deceptive link techniques such as embedding a trusted-looking domain before an @ (e.g., login.microsoft.com@...)—where the portion before @ is treated as username data and the actual destination is what follows—often combined with URL shorteners to increase click-through and evade user scrutiny.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Additional reporting expands Starkiller's described capabilities
Later reporting said Starkiller also targets platforms including Apple and Facebook and may include modules for financial fraud, such as theft of credit card data and cryptocurrency wallet recovery phrases. This expanded the public understanding of the framework beyond basic credential harvesting and session hijacking.
Starkiller is publicly attributed to the Jinkusu operation
Subsequent coverage attributed Starkiller to a threat group or operation calling itself Jinkusu, which was described as selling the service and related add-on capabilities through a criminal ecosystem. Reports said the offering included features such as session monitoring, credential alerts, and harvesting of additional contact or account data from compromised sessions.
Researchers report Starkiller can bypass MFA via reverse-proxy session theft
Public reporting described Starkiller as a phishing-as-a-service platform that uses an adversary-in-the-middle reverse proxy to capture credentials, MFA inputs, and session tokens in real time, enabling account takeover even when MFA is completed successfully. The reporting also noted operational features such as containerized browser sessions, deceptive URL masking, and real-time monitoring of victim sessions.
Abnormal AI publishes research on the Starkiller phishing framework
Abnormal AI disclosed Starkiller as a phishing framework that proxies real login pages through attacker-controlled infrastructure, centralizes campaign operations in a control panel, and supports impersonation of major brands such as Microsoft and Google. The research highlighted how the framework lowers the barrier to running large-scale credential and session theft campaigns.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
New Phishing Framework Starkiller Proxies Real Login Pages to Bypass MFA - Cyber Security News
cybersecuritynews.com
Open sourceNovel Starkiller phishing kit harnesses legitimate login sites | SC Media
scworld.com
Open source‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA - Krebs on Security
krebsonsecurity.com
Open sourceBest-in-Class 'Starkiller' Phishing Kit Bypasses MFA
darkreading.com
Open sourceStarkiller Phishing Framework Proxies Real Login Pages… | Abnormal AI
abnormal.ai
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Starkiller Adversary-in-the-Middle Phishing Suite Bypasses MFA via Reverse Proxy
Researchers disclosed **Starkiller**, a phishing-as-a-service suite advertised by a group calling itself **Jinkusu** that uses an **adversary-in-the-middle (AiTM) reverse proxy** to bypass multi-factor authentication by relaying victims to *live* legitimate login pages while capturing credentials and session tokens for account takeover. The tooling reportedly runs a headless Chrome instance inside a **Docker** container to load the real target site and proxy traffic end-to-end, reducing the need for static phishing templates and making fingerprinting/blocklisting harder; it also provides an operator dashboard to select brands/URLs to impersonate, supports lure keyword customization (e.g., “login,” “verify,” “security,” “account”), and integrates URL shorteners (e.g., *TinyURL*) to mask destinations. Separate reporting described a targeted AiTM intrusion attempt that used multiple redirect hops and an **ASP.NET Core** reverse proxy in front of Microsoft 365 login pages, but the author could not attribute it to any known commercial kit based on published AiTM “cheat sheets,” highlighting ongoing evolution and diversification of reverse-proxy phishing stacks beyond commonly documented PHP/Node/Go/Python implementations. Other items in the set cover unrelated malware and threat activity (Android trojans, an Iraq-focused APT campaign, an APT42 PowerShell backdoor, malvertising redirect mechanics, and scam-infrastructure/supply-chain activity) and do not materially add to the Starkiller AiTM disclosure.
Jun 29, 2026
Sophisticated Phishing Campaigns Leveraging Advanced Kits and Evasion Techniques
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026
Phishing Campaigns Evade Detection by Abusing AI and Trusted Email Security Controls
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026