New widespread EvilTokens kit: device code phishing as-a-service - Part 1 Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud

In early March 2026, we uncovered #EvilTokens, a new #PhaaS offering device code phishing pages and AI-driven features to automate and scale BEC workflows.

Part 1 of our analysis provides a technical analysis of the EvilTokens kit ⬇️

blog.sekoia.io/new-widespre...

EvilTokens: New Device Code PhaaS

~Sekoia~
EvilTokens is a new PhaaS kit automating Microsoft device code phishing to bypass MFA and execute BEC attacks.
-
IOCs: authdocspro. com, backdoor-hub. com, bumpgames. net
-
#EvilTokens #PhaaS #Phishing #threatintel

How phishing service Tycoon 2FA went under Microsoft, together with Europol and international partners, has disrupted the phishing-as-a-service provider Tycoon 2FA. The service sent tens of million...

#Security #cybersecurity #Digital #Crimes #Unit #europol #MFA […]

[Original post on techzine.eu]

Sneaky2FA: il phishing che ruba credenziali con attacchi browser-in-the-browser

📌 Link all'articolo : www.redhotcyber.com/post/sne...

#redhotcyber #news #sneaky2fa #phaas #browserinthebrowser #cybersecurity #hacking #phishing

Sneaky2FA usa tecniche BITB per evadere 2FA e rubare sessioni, con evoluzioni PhaaS che aumentano stealth e sofisticazione.

#2FA #BITB #PhaaS #phishingasaservice #PushSecurity #Sneaky2FA
www.matricedigitale.it/2025/11/20/s...

 Google Sues China-Based Hackers Behind $1 Billion Lighthouse Phishing Platform Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries. The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit trusted brands like E-ZPass and USPS to

iT4iNT SERVER  Google Sues China-Based Hackers Behind $1 Billion Lighthouse Phishing Platform VDS VPS Cloud #Google #CyberSecurity #Phishing #Hackers #PhaaS

Microsoft 365 Users Face New Automated Phishing Threat - WinBuzzer A new Phishing-as-a-Service (PhaaS) platform called Quantum Route Redirect is enabling automated, global attacks against Microsoft 365 users.

winbuzzer.com/2025/11/12/m...

Microsoft 365 Users Face New Automated Phishing Threat

#Cybersecurity #Phishing #Microsoft365 #InfoSec #CyberAttack #ThreatIntel #PhaaS #Microsoft #EmailSecurity #Cybercrime #DataSecurity #KnowBe4 #Hacking

Cybersecurity alert: Over 17,500 phishing domains linked to PhaaS platforms like Lucid and Lighthouse are targeting 316 brands across 74 countries. Stay vigilant! #CyberSecurity #Phishing #PhaaS Link: thedailytechfeed.com/global-surge...

Salty 2FA: Undetected PhaaS from Storm-1575 Targets US and EU Industries Salty 2FA is a newly discovered, undetected Phishing-as-a-Service (PhaaS) framework linked to Storm-1575 and Storm-1747

🚨 New #PhaaS: Salty 2FA linked to Storm-1575 is bypassing Microsoft 365 2FA & hitting global industries.

See advanced TTPs, evasion, and IOCs.

Full analysis & defender EDL: www.cyberintelligence.dev/salty-2fa-un...
#Cybersecurity #ThreatIntel

🚨 New Phishing-as-a-Service Threat! 🚨
VoidProxy Targets Microsoft 365 & Google Workspace Users.
#VoidProxy #CyberSecurity #Phishing #Microsoft365 #GoogleWorkspace #CloudSecurity #PhaaS #BEC #Technijian #ITSecurity #DarkWeb #DataBreach

New PhaaS 'Salty 2FA' Targets US/EU

~Anyrun~
New PhaaS 'Salty 2FA' targets US/EU orgs, bypassing Microsoft 365 MFA with a multi-stage, evasive attack chain.
-
IOCs: marketplace24ei. ru, nexttradeitaly. it. com, frankfurtwebs. com. de
-
#PhaaS #Phishing #Salty2FA #ThreatIntel

Rise of AitM Phishing-as-a-Service

~Sekoia~
Report details the surge in Adversary-in-the-Middle (AitM) Phishing-as-a-Service, ranking Tycoon 2FA, Storm-1167, and NakedPages as top threats.
-
IOCs: Tycoon 2FA, Storm-1167, NakedPages
-
#AitM #PhaaS #ThreatIntel

Phishing-as-a-Service is revolutionizing cybercrime, enabling even novices to launch sophisticated attacks. Organizations must enhance defenses to combat this growing threat. #CyberSecurity #Phishing #PhaaS Link: thedailytechfeed.com/phishing-as-...

Do-It-Yourself Cyberattack Tools Are Booming More wannabe cybercriminals are turning to user-friendly online tool kits designed to help them steal login credentials, passwords, credit card numbers and other sensitive data.

"More wannabe cybercriminals are turning to user-friendly online tool kits designed to help them steal login credentials, passwords, credit card numbers and other sensitive data."

www.wsj.com/articles/do-... #cybersecurity #crime #phishing #PhaaS

🛡️ #Phishing is evolving - and so is the criminal toolkit behind it.

New #PhaaS platforms like Tycoon 2FA make it easier to bypass MFA & target entire supply chains.

Know the risks. Build resilience.

#RetailSecurity #CyberSecurity #RHISAC #ThreatIntel #CyberResilience

FBI Uncovers 42,000 LabHost Phishing Domains – Cybercrime The FBI dismantled LabHost, a phishing-as-a-service network tied to 42,000 fake domains targeting millions. Discover how to protect your...

🚨 42,000 phishing domains shut down!
FBI takes down LabHost, a PhaaS platform used by 10K+ cybercriminals.

🔗 Blog: technijian.com/cyber-securi...
🎧 Podcast: technijian.com/podcast/fbi-...

#CyberSecurity #FBI #Phishing #LabHost #PhaaS #SIEM #Technijian #CyberCrime

偽ログイン画面をユーザーに合わせて変更、新手のフィッシング詐欺の脅威を認識せよ ユーザーが利用しているメールサービスを特定し、そのログイン画面に見せかけた偽画面を動的に生成するフィッシング詐欺が確認された。一体、どのような手口なのだろうか。

偽ログイン画面をユーザーに合わせて変更、新手のフィッシング詐欺の脅威を認識せよ #NikkeiXtech (Apr 16)

#フィッシング詐欺 #PhaaS #メールセキュリティ #BEC対策 #MorphingMeerkat

PhaaS boosts phishing tool access. Tycoon2FA bypasses MFA w/ code tricks & CAPTCHAs, joining a rising trend of malicious SVG attacks. #PhaaS #Cybercrime #TechTrends

www.bleepingcomputer.com/news/securit...

Tycoon2FA phishing kit rolled out significant updates The operators of the Phishing-as-a-Service platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities.

Tycoon2FAフィッシングキットが大幅にアップデート

Tycoon2FA phishing kit rolled out significant updates #SecurityAffairs (Apr 14)

#Tycoon2FA #フィッシングキット #PhaaS #検出回避 #サイバーセキュリティ

Catalyst

The Lucid Phishing-as-a-Service (PhAAS) platform, developed by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services.

catalyst.prodaft.com/public/repor...

#PhAAS #imessage #apple #rcs

新たなサイバー脅威『Morphing Meerkat』がもたらすフィッシングの危機 高度化するフィッシング攻撃『Morphing Meerkat』が企業に及ぼす影響と対策について解説。サイバー犯罪者の新手法から身を守るために必要な対策を考察します。

新たなサイバー脅威『Morphing Meerkat』がもたらすフィッシングの危機 #東京都 #港区 #フィッシング #Cybersecurity #PhaaS

高度化するフィッシング攻撃『Morphing Meerkat』が企業に及ぼす影響と対策について解説。サイバー犯罪者の新手法から身を守るために必要な対策を考察します。

Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing XinXin gang (also known as Black Technology) read more about Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing.

Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing reconbee.com/lucid-phaas-...

#Lucid #PhaaS #imessage #RCSsmishing #cyberattack #CyberSecurity #CybersecurityAttack #CyberSec

A phishing-as-a-service #PhaaS platform named 'Lucid' has been targeting 169 entities in 88 countries using well-crafted messages sent on iMessage (iOS) and RCS (Android)☝️☠️ #hacking

buff.ly/DqmJ8x1

Morphing Meerkat PhaaS Platform Spoofs 100+ Brands A PhaaS platform, dubbed 'Morphing Meerkat,' uses DNS MX records to spoof over 100 brands and steal credentials, according to Infoblox Threat Intel

モーフィング Meerkat PhaaS プラットフォームが 100 以上のブランドになりすます

Morphing Meerkat PhaaS Platform Spoofs 100+ Brands #InfosecurityMagazine (Mar 28)

#MorphingMeerkat #フィッシング #PhaaS #DNS攻撃 #サイバーセキュリティ

Phishing-as-a-service operation uses DNS-over-HTTPS for evasion A newly discovered phishing-as-a-service (PhaaS) operation that researchers call Morphing Meerkat, has been using the DNS over HTTPS (DoH) protocol to evade detection.

フィッシング・アズ・ア・サービスでは、DNS-over-HTTPS を利用して回避している

Phishing-as-a-service operation uses DNS-over-HTTPS for evasion #BleepingComputer (Mar 28)

#MorphingMeerkat #フィッシング #DNSoverHTTPS #サイバーセキュリティ #PhaaS

Original post on mastodon.social

Phishing-as-a-service is an area that is increasing rapidly according to research by security vendor Barracuda Networks, which says it has detected a “massive spike” in PhaaS attacks in the first two months of this year […]

Darcula PhaaS can now auto-generate phishing kits for any brand The Darcula phishing-as-a-service (PhaaS) platform is preparing to release its third major version, with one of the highlighted features, the ability to create do-it-yourself phishing kits to target a...

'Phishing as a Service' (PhaaS) Darcula v3 can auto-generate phishing kits for any brand.

www.bleepingcomputer.com/news/securit...

#Phishing #PhaaS #Darcula

Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand - Help Net Security An improved version of the Darcula PhaaS platform will allow malicious users to create customized phishing kits to target any brand.

Darculaは、技術に疎い犯罪者があらゆるブランドを狙ったDIYフィッシングキットを作成し、展開することを可能にする

Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand #HelpNetSecurity (Feb 20)

#Darcula #フィッシング #PhaaS #サイバー犯罪 #デジタルウォレット