A stealthy new phishing-as-a-service offering lets customers use cleverly disguised links to load the target brand’s real website, and then acts as a relay between the victim and the legitimate site – forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses. “The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.”
Relevant URL: https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/
