[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0LFwgrO9zPDA3sPSHkI5uZtA2qurvR1kO6LjcJ13_Wc":3},{"article":4,"iocs":31,"watch_terms":35},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":10,"entities":15,"category_id":16,"category":17,"article_tags":20},"49a76ef5-b5b9-433e-80f9-858487f5f2d5","‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA","starkiller-phishing-service-proxies-real-login-pages-mfa","Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the target and the legitimate site -- forwarding the victim's username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.","A new phishing-as-a-service platform called 'Starkiller' bypasses traditional phishing detection by proxying legitimate login pages in real-time. Rather than hosting static copies, it uses disguised links to load authentic brand websites while acting as a relay to capture credentials and MFA codes, then forwards them to the legitimate site to maintain access.",null,"https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F02\u002Fstarkiller-phishing-service-proxies-real-login-pages-mfa\u002F","https:\u002F\u002Fkrebsonsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F02\u002Fstarkiller-urlmasker.png","2026-02-20T20:00:30+00:00","2026-03-14T09:41:13.982824+00:00",[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":16,"icon":10,"name":18,"slug":19},"Malware","malware",[21,26],{"category":22},{"id":23,"icon":10,"name":24,"slug":25},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":27},{"id":28,"icon":10,"name":29,"slug":30},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[32],{"type":19,"value":33,"context":34},"Starkiller","Phishing-as-a-service platform that proxies legitimate login pages and relays credentials\u002FMFA codes",[]]