Originally reported by Krebs on Security
TL;DR
New Starkiller phishing service uses reverse proxy techniques to relay real login pages and intercept MFA tokens in real-time, bypassing traditional anti-phishing defenses.
Active phishing-as-a-service platform enabling MFA bypass represents a significant escalation in phishing sophistication, with immediate threat to organizations relying on traditional MFA protections.
Krebs on Security has identified a sophisticated phishing-as-a-service platform called "Starkiller" that fundamentally changes the phishing threat model. Unlike traditional static phishing pages that copy login interfaces, Starkiller operates as a reverse proxy between victims and legitimate websites.
The service loads actual target websites through cleverly disguised URLs, then intercepts and forwards all authentication data, including usernames, passwords, and multi-factor authentication codes, to the legitimate destination in real-time. This approach provides two critical advantages over conventional phishing operations:
The Starkiller platform addresses traditional phishing operational challenges through technical innovation:
As a phishing-as-a-service offering, Starkiller lowers the technical barrier for threat actors while providing:
This technique represents a significant escalation in phishing sophistication that challenges existing security assumptions:
Multi-Factor Authentication Bypass: Traditional MFA provides limited protection against real-time relay attacks, as tokens can be captured and immediately forwarded to legitimate services before expiration.
Detection Evasion: Static content analysis and URL reputation systems face reduced effectiveness when confronting proxy-based architectures that serve legitimate content through malicious infrastructure.
User Training Limitations: Standard phishing awareness training emphasizing suspicious URLs and fake login pages becomes less applicable when users interact with genuine website interfaces.
Organizations should evaluate current phishing defenses against proxy-based attack vectors:
https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/
Originally reported by Krebs on Security