Cybersecurity researchers have disclosed a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies, which is used as a proxy to redirect Microsoft 365…
NovaCookies is a subscription-based phishing-as-a-service (PhaaS) toolkit that uses adversary-in-the-middle (AitM) techniques to steal Microsoft 365 sessions. It is sold for $320…
AnonyMousKIT is a phishing-as-a-service platform that uses AI voice agents and multi-channel lures to steal Apple device passcodes and 2FA codes from…
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has expanded its capabilities to include device code phishing, a technique that abuses the…
Greatness is a commercial phishing-as-a-service (PhaaS) toolkit that has evolved to include device code phishing, AiTM token theft, and OAuth consent abuse.…
A new phishing-as-a-service (PhaaS) operation called Forg365 is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, AI-assisted…
The Quarry is a PhaaS kit developed by a lone operator named RockyBelling, used for credential theft via emails mimicking IRS, SSA,…
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
DEBULL is a reusable tooling layer that packages Storm-2372-style identity tradecraft into a PhaaS platform. It provides campaign-facing and operator-facing infrastructure, using…
EvilTokens is a phishing kit that steals Microsoft 365 tokens through the OAuth device code flow. It also provides AI-powered analytics services…