Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

Summary: A new phishing-as-a-service offering called Starkiller loads the target brand's real login page through a Docker container running headless Chrome, then acts as a man-in-the-middle reverse proxy that forwards the victim's username, password and MFA code to the legitimate site and returns its responses. According to an analysis by Abnormal AI, the service lets customers pick a brand to impersonate and generates masked URLs such as "login.microsoft.com@[malicious URL]", while logging every keystroke, session token and cookie and sending automated Telegram alerts when new credentials arrive.

What you should know: Because the victim authenticates against the real site through the proxy, Abnormal notes that MFA protections can be effectively neutralized despite functioning exactly as designed, and the service's dashboard of visit counts and conversion rates hands low-skill criminals capabilities that were previously out of reach.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related