{"id":140,"date":"2026-03-03T13:13:14","date_gmt":"2026-03-03T13:13:14","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=140"},"modified":"2026-03-03T13:13:14","modified_gmt":"2026-03-03T13:13:14","slug":"starkiller-phishing-suite-uses-aitm-reverse-proxy-to-bypass-multi-factor-authentication","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=140","title":{"rendered":"Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller<\/strong> that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections.<\/p>\n

It’s advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand’s real URL. It also lets users choose custom keywords like \u00ablogin,\u00bb \u00abverify,\u00bb \u00absecurity,\u00bb or \u00abaccount,\u00bb and integrates URL shorteners such as TinyURL to obscure the destination URL.<\/p>\n

\u00abIt launches a headless Chrome instance<\/a> \u2013 a browser that operates without a visible window \u2013 inside a Docker container<\/a>, loads the brand’s real website, and acts as a reverse proxy between the target and the legitimate site,\u00bb Abnormal researchers Callie Baron and Piotr Wojtyla said<\/a>.<\/p>\n

\u00abRecipients are served genuine page content directly through the attacker’s infrastructure, ensuring the phishing page is never out of date. And because Starkiller proxies the real site live, there are no template files for security vendors to fingerprint or blocklist.\u00bb<\/p>\n

This login page proxying technique obviates the need for attackers to update their phishing page templates periodically as the real pages they’re impersonating get updated.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Put differently, the container acts as an AitM reverse proxy, forwarding the end user’s inputs entered on the spoofed live page to the legitimate site and returning the site’s responses. Under the hood, every keystroke, form submission, and session token is routed through attacker-controlled infrastructure and is captured for account takeover.<\/p>\n

\u00abThe platform streamlines phishing operations by centralizing infrastructure management, phishing page deployment, and session monitoring within a single control panel,\u00bb Abnormal said. \u00abCombined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.\u00bb<\/p>\n

The development comes as Datadog revealed that the 1Phish kit had evolved from a basic credential harvester in September 2025 into a multi-stage phishing kit targeting 1Password users.<\/p>\n

<\/p>\n

The updated version of the kit incorporates a pre-phishing fingerprint and validation layer, support for capturing one-time passcodes (OTPs) and recovery codes, and browser fingerprinting logic to filter out bots.<\/p>\n

\u00abThis progression reflects deliberate iteration rather than simple template reuse,\u00bb security researcher Martin McCloskey said<\/a>. \u00abEach version builds upon the previous one, introducing controls designed to increase conversion rates, reduce automated analysis, and support secondary authentication harvesting.\u00bb<\/p>\n

The findings show that turkey solutions like Starkiller and 1Phish are increasingly turning phishing into SaaS-style workflows, further lowering the skill barrier necessary to pull off such attacks at scale.<\/p>\n

They also coincide with a sophisticated phishing campaign targeting North American businesses and professionals by abusing the OAuth 2.0 device authorization grant flow to sidestep multi-factor authentication (MFA) and compromise Microsoft 365 accounts.<\/p>\n

To achieve this, the attacker registers on the Microsoft OAuth application and generates a unique device code, which is then delivered to the victim via a targeted phishing email.<\/p>\n

\u00abThe victim is directed to the legitimate Microsoft domain (microsoft.com\/devicelogin) portal to enter an attacker-supplied device code<\/a>,\u00bb researchers Jeewan Singh Jalal, Prabhakaran Ravichandhiran, and Anand Bodke said<\/a>. \u00abThis action authenticates the victim and issues a valid OAuth access token to the attacker’s application. The real-time theft of these tokens grants the attacker persistent access to the victim’s Microsoft 365 accounts and corporate data.\u00bb<\/p>\n

In recent months, phishing campaigns have also targeted financial institutions, specifically U.S.-based banks and credit unions, to harvest credentials. The campaign is said to have taken place over two distinct phases, an initial wave beginning in late June 2025 and a more sophisticated set of attacks beginning in mid-November 2025.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe actors began registering [.]co[.]com domains spoofing financial institution websites, presenting credible impersonations of real financial institutions,\u00bb BlueVoyant researchers Shira Reuveny and Joshua Green said<\/a>. \u00abThese [.]co[.]com domains serve as the initial entry point in a refined multi-stage chain.\u00bb<\/p>\n

The domain, when visited from a clickable link in a phishing email, is designed to load a fraudulent Cloudflare CAPTCHA page that mimics the targeted institution. The CAPTCHA is non-functional and creates a deliberate delay before a Base64-encoded script redirects users to the credential harvesting page.<\/p>\n

In an effort to evade detection and prevent automated scanners from flagging the malicious content, directly accessing the [.]co[.]com domains trigger a redirect to a malformed \u00abwww[.]www\u00bb URL.<\/p>\n

\u00abThe adversary’s deployment of a more advanced multi-layered evasion chain \u2013 incorporating referrer validation, cookie-based access controls, intentional delays, and code obfuscation \u2013 effectively creates a more resilient infrastructure that presents barriers for automated security tools and manual analysis,\u00bb BlueVoyant said.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections. It’s advertised as a cybercrime platform by…<\/p>\n","protected":false},"author":1,"featured_media":141,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[392,396,394,395,390,354,393,389,391],"class_list":["post-140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-aitm","tag-authentication","tag-bypass","tag-multifactor","tag-phishing","tag-proxy","tag-reverse","tag-starkiller","tag-suite"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=140"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/140\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/141"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}