TL;DR
["A new 'Starkiller' phishing-as-a-service offers a sophisticated attack vector using real login pages and multi-factor authentication (MFA) code interception, posing significant risks to users and organizations."]
What happened
["A stealthy phishing service named Starkiller uses cleverly disguised links that load target brand's real websites as proxies.", 'This service forwards victim’s credentials including MFA codes directly to the legitimate sites and captures responses for attackers to use.']
Why it matters for ops
['Starkiller leverages real login pages, reducing detection by security teams who monitor static phishing copies.', 'The method bypasses typical preventive measures like MFA, making it harder to identify and block malicious activities.']
Mitigation
- Implement additional layers of authentication beyond MFA
- Monitor and analyze access logs for anomalous behavior
Action items
- Review current MFA solutions and their effectiveness against proxy-based attacks.
- Educate users on recognizing suspicious login behaviors and the risks of phishing.
Detection IOCs
- Sudden increase in login attempts from the same IP address
- Unusual patterns of successful logins followed by rapid account takeover
Source link
https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/