MalwareFeb 20, 2026
‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA
A new phishing-as-a-service platform called 'Starkiller' bypasses traditional phishing detection by proxying legitimate login pages in real-time. Rather than hosting static copies, it uses disguised links to load authentic brand websites while acting as a relay to capture credentials and MFA codes, then forwards them to the legitimate site to maintain access.
Summary
A new phishing-as-a-service platform called 'Starkiller' bypasses traditional phishing detection by proxying legitimate login pages in real-time. Rather than hosting static copies, it uses disguised links to load authentic brand websites while acting as a relay to capture credentials and MFA codes, then forwards them to the legitimate site to maintain access.
Indicators of Compromise
- malware — Starkiller