{"id":9774,"date":"2026-04-15T15:06:00","date_gmt":"2026-04-15T15:06:00","guid":{"rendered":"https:\/\/fortgale.com\/blog\/?p=9774"},"modified":"2026-05-06T09:41:35","modified_gmt":"2026-05-06T09:41:35","slug":"phishing-kits-bypass-mfa","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/defence\/phishing-kits-bypass-mfa\/","title":{"rendered":"Phishing Kits Bypass MFA\u00a0and Hijack companies&#8217;s accounts in minutes"},"content":{"rendered":"\n<!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n     FORTGALE \u00b7 TECHNICAL BLOG \u00b7 Phishing Kit 2026\n     Template: \u00a75.5 Technical blog \u00b7 Voice: Verbal Identity \u00a72 \u00b7 Visual: \u00a73\n     \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n<link rel=\"preconnect\" href=\"https:\/\/fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https:\/\/fonts.gstatic.com\" crossorigin>\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=IBM+Plex+Sans:wght@300;400;500;600;700&#038;family=IBM+Plex+Serif:ital,wght@1,400&#038;family=Inter:wght@300;400;500;600;700&#038;family=JetBrains+Mono:wght@400;500;600&#038;display=swap\" rel=\"stylesheet\">\n\n<style>\n  \/* \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n     DESIGN TOKENS \u00b7 Fortgale Brand Identity 2026 (v1.1)\n     \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 *\/\n  .fg-article {\n    \/* \u2014 surfaces & ink \u2014 *\/\n    --bg-void: #02040A;\n    --bg-deep: #050A1C;\n    --bg-panel-solid: #07122A;\n    --bg-light: #ECECEF;\n    --bg-light-2: #E2E2E6;\n    --card-light: #FFFFFF;\n    --ink: #E6F0FF;\n    --ink-dim: #8FA6C9;\n    --ink-mute: #5A7099;\n    --ink-light: #0F1117;\n    --ink-body: #4B5563;\n    \/* \u2014 Fortgale blue accent \u2014 *\/\n    --blue-elec: #22D3FF;\n    --blue: #00A3FF;\n    --blue-hot: #0066FF;\n    --accent-dark: #0369A1;\n    \/* \u2014 signals \u2014 *\/\n    --red-alert: #FF2E5C;\n    --amber: #FFB020;\n    --violet: #8B5CF6;\n    --magenta: #C026D3;\n    --ok: #10B981;\n    \/* \u2014 angular clip-paths \u2014 *\/\n    --clip-sm: polygon(8px 0, 100% 0, 100% calc(100% - 8px), calc(100% - 8px) 100%, 0 100%, 0 8px);\n    --clip-md: polygon(14px 0, 100% 0, 100% calc(100% - 14px), calc(100% - 14px) 100%, 0 100%, 0 14px);\n    --clip-lg: polygon(20px 0, 100% 0, 100% calc(100% - 20px), calc(100% - 20px) 100%, 0 100%, 0 20px);\n  }\n\n  \/* \u2500\u2500 Base \u2500\u2500 *\/\n  .fg-article {\n    font-family: 'Inter', 'Segoe UI', system-ui, -apple-system, sans-serif;\n    color: var(--ink-body);\n    line-height: 1.75;\n    max-width: 820px;\n    margin: 0 auto;\n    text-align: justify;\n    font-size: 16px;\n  }\n  .fg-article h2 {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    color: var(--ink-light);\n    font-size: 1.55em;\n    margin-top: 2.4em;\n    margin-bottom: 0.6em;\n    padding-bottom: 10px;\n    border-bottom: 2px solid var(--ink-light);\n    letter-spacing: -0.015em;\n    text-transform: none;\n    font-weight: 600;\n    line-height: 1.15;\n  }\n  .fg-article h2 em {\n    font-family: 'IBM Plex Serif', Georgia, serif;\n    font-style: italic;\n    font-weight: 400;\n    color: var(--accent-dark);\n  }\n  .fg-article h3 {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    color: var(--ink-light);\n    font-size: 1.15em;\n    margin-top: 1.8em;\n    margin-bottom: 0.5em;\n    text-transform: uppercase;\n    letter-spacing: 0.06em;\n    font-weight: 600;\n  }\n  .fg-article h4 {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    color: var(--ink-light);\n    font-size: 1.05em;\n    margin-top: 1.5em;\n    margin-bottom: 0.4em;\n    font-weight: 600;\n    letter-spacing: -0.01em;\n  }\n  .fg-article p {\n    margin-bottom: 1.15em;\n    font-size: 1em;\n    color: var(--ink-body);\n  }\n  .fg-article strong { color: var(--ink-light); font-weight: 600; }\n  .fg-article a {\n    color: var(--accent-dark);\n    text-decoration: none;\n    border-bottom: 1px solid rgba(3, 105, 161, 0.35);\n    transition: border-color 0.2s;\n  }\n  .fg-article a:hover { border-bottom-color: var(--accent-dark); }\n  .fg-article em {\n    font-family: 'IBM Plex Serif', Georgia, serif;\n    font-style: italic;\n    font-weight: 400;\n    color: var(--ink-light);\n  }\n\n  \/* \u2500\u2500 Meta & tagbar \u2500\u2500 *\/\n  .fg-kicker {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-size: 10.5px;\n    font-weight: 500;\n    color: var(--accent-dark);\n    text-transform: uppercase;\n    letter-spacing: 0.18em;\n    margin-bottom: 14px;\n    display: inline-flex;\n    align-items: center;\n    gap: 10px;\n  }\n  .fg-kicker::before {\n    content: '';\n    width: 8px; height: 8px;\n    background: var(--accent-dark);\n    border-radius: 50%;\n    animation: fg-pulse 2s infinite;\n  }\n  @keyframes fg-pulse {\n    0%, 100% { opacity: 1; }\n    50% { opacity: 0.4; }\n  }\n  @media (prefers-reduced-motion: reduce) {\n    .fg-kicker::before { animation: none; }\n  }\n  .fg-meta {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-size: 11.5px;\n    color: var(--ink-mute);\n    letter-spacing: 0.06em;\n    text-transform: uppercase;\n    margin-bottom: 32px;\n    padding-bottom: 22px;\n    border-bottom: 1px solid #d8d8d8;\n  }\n  .fg-meta span + span::before { content: ' \u00b7 '; color: var(--accent-dark); }\n\n  \/* \u2500\u2500 Divider \u2500\u2500 *\/\n  .fg-divider { border: none; border-top: 1px solid #d8d8d8; margin: 2.2em 0; }\n\n  \/* \u2500\u2500 Info box \u2500\u2500 *\/\n  .fg-infobox {\n    background: #f7f8fa;\n    border: 1px solid #dde0e6;\n    padding: 26px 30px;\n    margin: 28px 0;\n    position: relative;\n    clip-path: var(--clip-md);\n  }\n  .fg-infobox::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--accent-dark);\n  }\n  .fg-infobox-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--ink-light);\n    font-size: 0.88em;\n    margin-bottom: 14px;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n    display: flex; align-items: center; gap: 10px;\n  }\n  .fg-infobox ul { margin: 0; padding-left: 18px; }\n  .fg-infobox li {\n    margin-bottom: 10px;\n    font-size: 0.96em;\n    color: var(--ink-body);\n    line-height: 1.7;\n  }\n  .fg-infobox li strong { color: var(--ink-light); }\n\n  \/* \u2500\u2500 Operation (severity alta\/critica) \u2500\u2500 *\/\n  .fg-operation {\n    background: #fafafa;\n    border: 1px solid #e0e0e0;\n    padding: 24px 28px;\n    margin: 30px 0;\n    position: relative;\n    clip-path: var(--clip-md);\n  }\n  .fg-operation::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--red-alert);\n  }\n  .fg-operation-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--red-alert);\n    font-size: 0.88em;\n    margin-bottom: 10px;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n    display: flex; align-items: center; gap: 10px;\n  }\n  .fg-operation p { margin: 0; color: var(--ink-body); }\n\n  \/* \u2500\u2500 Containment \/ success \u2500\u2500 *\/\n  .fg-containment {\n    background: #f7f8fa;\n    border: 1px solid #dde0e6;\n    padding: 24px 28px;\n    margin: 36px 0;\n    position: relative;\n    clip-path: var(--clip-md);\n  }\n  .fg-containment::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--ok);\n  }\n  .fg-containment-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--ok);\n    font-size: 0.88em;\n    margin-bottom: 8px;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n    display: flex; align-items: center; gap: 10px;\n  }\n  .fg-containment p { margin: 0; }\n\n  \/* \u2500\u2500 Assessment \u2500\u2500 *\/\n  .fg-assessment {\n    background: #fafafa;\n    border: 1px solid #e0e0e0;\n    padding: 26px 30px;\n    margin: 30px 0;\n    position: relative;\n    clip-path: var(--clip-md);\n  }\n  .fg-assessment::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--ink-light);\n  }\n  .fg-assessment-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--ink-light);\n    font-size: 0.88em;\n    margin-bottom: 10px;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n  }\n  .fg-assessment p { margin: 0 0 10px; color: var(--ink-body); }\n  .fg-assessment p:last-child { margin-bottom: 0; }\n  .fg-assessment-red { background: #fdf2f2; border-color: #f0d0d0; }\n  .fg-assessment-red::before { background: var(--red-alert); }\n  .fg-assessment-red .fg-assessment-title { color: var(--red-alert); }\n\n  \/* \u2500\u2500 Flow diagram \u2500\u2500 *\/\n  .fg-flow { margin: 36px 0; overflow-x: auto; }\n  .fg-flow svg { display: block; margin: 0 auto; max-width: 100%; height: auto; }\n\n  \/* \u2500\u2500 Stack cards \u2500\u2500 *\/\n  .fg-stack { display: flex; flex-wrap: wrap; gap: 14px; justify-content: center; margin: 32px 0; }\n  .fg-stack-item {\n    background: var(--card-light);\n    border: 1px solid #d0d0d0;\n    padding: 22px 18px 18px;\n    text-align: center;\n    min-width: 155px;\n    flex: 1;\n    max-width: 200px;\n    position: relative;\n    transition: box-shadow 0.25s, transform 0.25s;\n    clip-path: var(--clip-sm);\n  }\n  .fg-stack-item::before {\n    content: ''; position: absolute;\n    top: 0; left: 0; right: 0; height: 3px;\n    background: var(--accent-dark);\n  }\n  .fg-stack-item:hover { box-shadow: 0 4px 16px rgba(0,0,0,0.08); transform: translateY(-2px); }\n  .fg-stack-item .fg-stack-icon { font-size: 1.6em; margin-bottom: 8px; color: var(--accent-dark); }\n  .fg-stack-item .fg-stack-name {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-weight: 600;\n    color: var(--ink-light);\n    font-size: 0.98em;\n    letter-spacing: -0.01em;\n  }\n  .fg-stack-item .fg-stack-role {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-size: 0.76em;\n    color: var(--ink-mute);\n    margin-top: 6px;\n    letter-spacing: 0.04em;\n    text-transform: uppercase;\n  }\n\n  \/* \u2500\u2500 Timeline \u2500\u2500 *\/\n  .fg-timeline { position: relative; margin: 32px 0 32px 16px; padding-left: 30px; border-left: 2px solid #d0d0d0; }\n  .fg-timeline-item { position: relative; margin-bottom: 26px; }\n  .fg-timeline-item::before {\n    content: ''; position: absolute;\n    left: -37px; top: 5px;\n    width: 12px; height: 12px;\n    background: var(--ink-light);\n    border-radius: 50%;\n    border: 3px solid #fff;\n    box-shadow: 0 0 0 2px var(--ink-light);\n  }\n  .fg-timeline-item:last-child::before {\n    background: var(--red-alert);\n    box-shadow: 0 0 0 2px var(--red-alert);\n  }\n  .fg-timeline-item .fg-tl-date {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--ink-mute);\n    font-size: 0.78em;\n    margin-bottom: 2px;\n    text-transform: uppercase;\n    letter-spacing: 0.12em;\n  }\n  .fg-timeline-item .fg-tl-title {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-weight: 600;\n    color: var(--ink-light);\n    font-size: 1.02em;\n    letter-spacing: -0.01em;\n  }\n  .fg-timeline-item .fg-tl-desc { color: var(--ink-body); font-size: 0.95em; margin-top: 4px; line-height: 1.65; }\n\n  \/* \u2500\u2500 Tables \u2500\u2500 *\/\n  .fg-table-wrap { overflow-x: auto; margin: 28px 0; }\n  .fg-table {\n    width: 100%;\n    border-collapse: collapse;\n    font-size: 0.92em;\n  }\n  .fg-table thead th {\n    background: var(--bg-panel-solid);\n    color: var(--ink);\n    padding: 12px 16px;\n    text-align: left;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 500;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n    font-size: 0.84em;\n  }\n  .fg-table tbody td {\n    padding: 12px 16px;\n    border-bottom: 1px solid #e8e8e8;\n    color: var(--ink-body);\n    vertical-align: top;\n    line-height: 1.6;\n  }\n  .fg-table tbody tr:nth-child(even) { background: #f9f9fb; }\n  .fg-table tbody tr:hover { background: #f0f1f5; }\n  .fg-table .fg-highlight-cell { color: var(--red-alert); font-weight: 600; }\n  .fg-table code {\n    background: #f0f1f5;\n    padding: 2px 6px;\n    font-size: 0.92em;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    color: var(--ink-light);\n    word-break: break-all;\n  }\n\n  \/* \u2500\u2500 Report card (malware detail) \u2500\u2500 *\/\n  .fg-malware-detail {\n    background: var(--card-light);\n    border: 1px solid #dde0e6;\n    margin: 24px 0;\n    position: relative;\n    clip-path: var(--clip-lg);\n  }\n  .fg-malware-detail-header {\n    background: var(--bg-panel-solid);\n    color: var(--ink);\n    padding: 16px 22px;\n    display: flex;\n    align-items: center;\n    gap: 12px;\n    position: relative;\n  }\n  .fg-malware-detail-header::before,\n  .fg-malware-detail-header::after {\n    content: '';\n    position: absolute;\n    width: 14px; height: 14px;\n    border: 2px solid var(--blue-elec);\n    opacity: 0.6;\n  }\n  .fg-malware-detail-header::before {\n    top: 6px; left: 6px;\n    border-right: none; border-bottom: none;\n  }\n  .fg-malware-detail-header::after {\n    top: 6px; right: 6px;\n    border-left: none; border-bottom: none;\n  }\n  .fg-malware-detail-header .fg-md-icon {\n    font-size: 1.3em;\n    color: var(--blue-elec);\n  }\n  .fg-malware-detail-header .fg-md-title {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-weight: 600;\n    font-size: 1.05em;\n    letter-spacing: -0.01em;\n    color: var(--ink);\n  }\n  .fg-malware-detail-header .fg-md-tag {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    background: rgba(34, 211, 255, 0.12);\n    border: 1px solid rgba(34, 211, 255, 0.3);\n    color: var(--blue-elec);\n    padding: 3px 10px;\n    font-size: 0.74em;\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n    margin-left: auto;\n  }\n  .fg-malware-detail-body { padding: 22px 24px; }\n  .fg-malware-detail-body p { margin-bottom: 12px; font-size: 0.97em; }\n  .fg-malware-detail-body p:last-child { margin-bottom: 0; }\n\n  \/* \u2500\u2500 Profile card \u2500\u2500 *\/\n  .fg-profile {\n    display: flex; gap: 28px; align-items: flex-start;\n    background: #f7f8fa; border: 1px solid #dde0e6;\n    padding: 28px 30px; margin: 30px 0;\n    position: relative;\n    clip-path: var(--clip-lg);\n  }\n  .fg-profile::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--accent-dark);\n  }\n  .fg-profile-badge { flex-shrink: 0; width: 80px; height: 80px; display: flex; align-items: center; justify-content: center; }\n  .fg-profile-info { flex: 1; }\n  .fg-profile-name {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-weight: 600;\n    color: var(--ink-light);\n    font-size: 1.18em;\n    margin-bottom: 4px;\n    letter-spacing: -0.015em;\n  }\n  .fg-profile-origin {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-size: 0.82em;\n    color: var(--ink-mute);\n    text-transform: uppercase;\n    letter-spacing: 0.08em;\n    margin-bottom: 10px;\n  }\n  .fg-profile-desc { font-size: 0.97em; color: var(--ink-body); line-height: 1.7; margin: 0; }\n\n  \/* \u2500\u2500 Numbered list \u2500\u2500 *\/\n  .fg-hypotheses { margin: 28px 0; padding: 0; list-style: none; counter-reset: hyp; }\n  .fg-hypotheses li {\n    position: relative;\n    padding: 20px 22px 20px 70px;\n    margin-bottom: 14px;\n    background: #f7f8fa;\n    border: 1px solid #dde0e6;\n    counter-increment: hyp;\n    clip-path: var(--clip-sm);\n  }\n  .fg-hypotheses li::before {\n    content: counter(hyp, decimal-leading-zero);\n    position: absolute;\n    left: 20px; top: 18px;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 600;\n    color: var(--accent-dark);\n    font-size: 1.4em;\n    line-height: 1;\n    letter-spacing: 0.02em;\n  }\n  .fg-hypotheses li strong {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    color: var(--ink-light);\n    display: block;\n    margin-bottom: 4px;\n    font-weight: 600;\n    letter-spacing: -0.01em;\n  }\n\n  \/* \u2500\u2500 Price tag \u2500\u2500 *\/\n  .fg-price {\n    display: inline-block;\n    background: var(--bg-panel-solid);\n    color: var(--blue-elec);\n    padding: 2px 10px;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 500;\n    font-size: 0.86em;\n    letter-spacing: 0.04em;\n  }\n\n  \/* \u2500\u2500 Key takeaways (executive summary) \u2500\u2500 *\/\n  .fg-exec {\n    background: var(--bg-panel-solid);\n    color: var(--ink);\n    padding: 30px 34px;\n    margin: 0 0 36px;\n    position: relative;\n    clip-path: var(--clip-lg);\n    overflow: hidden;\n  }\n  .fg-exec::after {\n    content: ''; position: absolute;\n    bottom: 0; left: 0;\n    width: 60px; height: 3px;\n    background: var(--blue-elec);\n  }\n  .fg-exec-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 500;\n    font-size: 0.78em;\n    text-transform: uppercase;\n    letter-spacing: 0.15em;\n    color: var(--ink-dim);\n    margin-bottom: 14px;\n  }\n  .fg-exec ul { margin: 0; padding-left: 0; list-style: none; }\n  .fg-exec li {\n    position: relative;\n    padding-left: 18px;\n    margin-bottom: 10px;\n    font-size: 0.96em;\n    line-height: 1.6;\n    color: var(--ink-dim);\n  }\n  .fg-exec li::before {\n    content: ''; position: absolute;\n    left: 0; top: 9px;\n    width: 6px; height: 6px;\n    background: var(--blue-elec);\n  }\n  .fg-exec li strong { color: var(--ink); font-weight: 600; }\n\n  \/* \u2500\u2500 TOC \u2500\u2500 *\/\n  .fg-toc {\n    background: #f7f8fa;\n    border: 1px solid #dde0e6;\n    padding: 24px 30px;\n    margin: 0 0 36px;\n    position: relative;\n    clip-path: var(--clip-md);\n  }\n  .fg-toc::before {\n    content: ''; position: absolute;\n    left: 0; top: 0; bottom: 0; width: 4px;\n    background: var(--accent-dark);\n  }\n  .fg-toc-title {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 500;\n    color: var(--ink-light);\n    font-size: 0.78em;\n    text-transform: uppercase;\n    letter-spacing: 0.15em;\n    margin-bottom: 14px;\n  }\n  .fg-toc ol { margin: 0; padding-left: 18px; counter-reset: toc; list-style: none; }\n  .fg-toc li { counter-increment: toc; margin-bottom: 7px; font-size: 0.93em; line-height: 1.5; }\n  .fg-toc li::before {\n    content: counter(toc, decimal-leading-zero);\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    color: var(--accent-dark);\n    font-weight: 600;\n    margin-right: 10px;\n    font-size: 0.88em;\n  }\n  .fg-toc a {\n    color: var(--ink-light);\n    text-decoration: none;\n    border-bottom: 1px solid transparent;\n    transition: color 0.2s, border-color 0.2s;\n  }\n  .fg-toc a:hover { color: var(--accent-dark); border-bottom-color: var(--accent-dark); }\n\n  \/* \u2500\u2500 CTA closing \u2500\u2500 *\/\n  .fg-cta {\n    background: var(--bg-panel-solid);\n    color: var(--ink);\n    padding: 40px 34px;\n    margin: 40px 0 0;\n    text-align: center;\n    position: relative;\n    overflow: hidden;\n    clip-path: var(--clip-lg);\n  }\n  .fg-cta::before {\n    content: ''; position: absolute;\n    top: 0; left: 0; right: 0;\n    height: 4px;\n    background: linear-gradient(90deg, var(--blue-hot), var(--blue-elec));\n  }\n  .fg-cta-kicker {\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-size: 10px;\n    color: var(--blue-elec);\n    text-transform: uppercase;\n    letter-spacing: 0.18em;\n    margin-bottom: 12px;\n  }\n  .fg-cta-title {\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-weight: 500;\n    font-size: 1.45em;\n    margin-bottom: 10px;\n    letter-spacing: -0.02em;\n    color: var(--ink);\n    line-height: 1.2;\n  }\n  .fg-cta-title em {\n    font-family: 'IBM Plex Serif', Georgia, serif;\n    font-style: italic;\n    font-weight: 400;\n    color: var(--blue-elec);\n  }\n  .fg-cta-sub { font-size: 0.95em; color: var(--ink-dim); margin-bottom: 22px; max-width: 560px; margin-left: auto; margin-right: auto; }\n  .fg-cta-links { display: flex; gap: 14px; justify-content: center; flex-wrap: wrap; }\n  .fg-cta-link {\n    display: inline-block;\n    padding: 12px 26px;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n    font-weight: 500;\n    font-size: 0.82em;\n    text-transform: uppercase;\n    letter-spacing: 0.12em;\n    text-decoration: none;\n    border: none;\n    transition: background 0.2s, color 0.2s, border-color 0.2s;\n    clip-path: var(--clip-sm);\n  }\n  .fg-cta-link-primary { background: var(--blue-hot); color: #fff; }\n  .fg-cta-link-primary:hover { background: var(--blue-elec); color: var(--bg-panel-solid); }\n  .fg-cta-link-secondary {\n    background: transparent;\n    color: var(--ink);\n    border: 1px solid rgba(230, 240, 255, 0.25) !important;\n  }\n  .fg-cta-link-secondary:hover { border-color: var(--blue-elec) !important; color: var(--blue-elec); }\n\n  \/* \u2500\u2500 Evolution diagram \u2500\u2500 *\/\n  .fg-evo-diagram { margin: 32px 0; overflow-x: auto; }\n  .fg-evo-diagram svg { display: block; margin: 0 auto; max-width: 100%; height: auto; }\n\n  \/* \u2500\u2500 Signature metrics row \u2500\u2500 *\/\n  .fg-metrics-row {\n    display: flex; flex-wrap: wrap; gap: 24px;\n    padding: 18px 0;\n    margin: 0 0 28px;\n    border-top: 1px solid #e0e0e0;\n    border-bottom: 1px solid #e0e0e0;\n    font-family: 'JetBrains Mono', 'Consolas', monospace;\n  }\n  .fg-metrics-row .fg-metric {\n    flex: 1; min-width: 140px;\n  }\n  .fg-metrics-row .fg-metric-val {\n    display: block;\n    font-family: 'IBM Plex Sans', system-ui, sans-serif;\n    font-size: 1.6em;\n    font-weight: 500;\n    color: var(--accent-dark);\n    letter-spacing: -0.02em;\n    line-height: 1;\n    margin-bottom: 4px;\n  }\n  .fg-metrics-row .fg-metric-label {\n    font-size: 0.72em;\n    color: var(--ink-mute);\n    text-transform: uppercase;\n    letter-spacing: 0.1em;\n  }\n\n  @media (max-width: 600px) {\n    .fg-profile { flex-direction: column; align-items: center; text-align: center; }\n    .fg-hypotheses li { padding-left: 60px; }\n    .fg-stack-item { min-width: 130px; }\n    .fg-cta-links { flex-direction: column; align-items: center; }\n    .fg-cta-link { width: 100%; max-width: 280px; }\n  }\n<\/style>\n\n<div class=\"fg-article\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       HERO META \u00b7 Tagbar + Meta (title removed, rendered upstream)\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-kicker\">Intelligence &middot; Phishing Kit &middot; Q1 2026<\/div>\n  <div class=\"fg-meta\">\n    <span>April 24, 2026<\/span><span>Fortgale CTI<\/span><span>14 min read<\/span><span>RPT-26-0424<\/span>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       BLUF\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-containment\">\n    <div class=\"fg-containment-title\">Observation of the quarter<\/div>\n    <p style=\"margin:0;\">The 2026 phishing ecosystem has outpaced traditional defenses. MFA alone is not enough. The answer is not one more product but a <em>managed defense<\/em> that combines <strong>phishing-resistant authentication<\/strong>, <strong>session-level detection<\/strong>, <strong>intelligence-driven<\/strong> and <strong>AI triage<\/strong>. \nAn attack is not an event. It&rsquo;s someone &mdash; and someone can be known, anticipated, stopped.<\/p>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       KEY TAKEAWAYS\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-exec\">\n    <div class=\"fg-exec-title\">Key takeaways<\/div>\n    <ul>\n      <li><strong>MFA based on OTP, SMS and push is no longer holding.<\/strong> Modern phishing kits intercept the authenticated session token in real time via Adversary-in-the-Middle reverse proxies. The password is irrelevant &mdash; the token is what matters.<\/li>\n      <li><strong>Phishing-as-a-Service has industrialized the attack.<\/strong> Turnkey platforms with MFA bypass, admin panel and hosting start at <span class=\"fg-price\">&euro;200 \/ 2 weeks<\/span> on Telegram. No technical skill required.<\/li>\n      <li><strong>EvilTokens introduces AI-driven post-compromise automation.<\/strong> Chained LLMs read the mailbox via Graph API, identify financial threads and generate BEC emails in under <strong>5 minutes<\/strong>, with zero human intervention.<\/li>\n      <li><strong>The adversary persists inside Microsoft 365 without malware.<\/strong> The stolen token grants full access via legitimate APIs &mdash; inbox rule abuse, invoice thread scanning, BEC fraud. Endpoint protection sees nothing.<\/li>\n      <li><strong>Only FIDO2 and passkeys resist.<\/strong> The cryptographic challenge is bound to the real domain and cannot be relayed through a proxy. Everything else is bypassable.<\/li>\n    <\/ul>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       SIGNATURE METRICS\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-metrics-row\">\n    <div class=\"fg-metric\">\n      <span class=\"fg-metric-val\">9<\/span>\n      <span class=\"fg-metric-label\">Phishing kits profiled Q1 2026<\/span>\n    <\/div>\n    <div class=\"fg-metric\">\n      <span class=\"fg-metric-val\">180+<\/span>\n      <span class=\"fg-metric-label\">Tracked adversaries in Fortgale CTI<\/span>\n    <\/div>\n    <div class=\"fg-metric\">\n      <span class=\"fg-metric-val\">~11 min<\/span>\n      <span class=\"fg-metric-label\">Median containment<\/span>\n    <\/div>\n    <div class=\"fg-metric\">\n      <span class=\"fg-metric-val\">24&middot;7&middot;365<\/span>\n      <span class=\"fg-metric-label\">European SOC operation<\/span>\n    <\/div>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       TOC\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-toc\">\n    <div class=\"fg-toc-title\">Contents<\/div>\n    <ol>\n      <li><a href=\"#mfa-bypass\">How phishing kits bypass MFA in 2026<\/a><\/li>\n      <li><a href=\"#m365-persistence\">Inside Microsoft 365: the post-compromise playbook<\/a><\/li>\n      <li><a href=\"#phaas-economy\">Phishing-as-a-Service: the rental economy<\/a><\/li>\n      <li><a href=\"#kit-arsenal\">The 2026 phishing kit arsenal<\/a><\/li>\n      <li><a href=\"#eviltokens\">Report: EvilTokens &mdash; LLM-automated BEC<\/a><\/li>\n      <li><a href=\"#rockstar-flowerstorm\">Report: Rockstar 2FA and FlowerStorm<\/a><\/li>\n      <li><a href=\"#blackforce\">Report: BlackForce &mdash; Man-in-the-Browser<\/a><\/li>\n      <li><a href=\"#infrastructure\">Keitaro TDS and Storm-2755: the infrastructure<\/a><\/li>\n      <li><a href=\"#defenses\">Operational recommendations<\/a><\/li>\n    <\/ol>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       1 \u00b7 MFA BYPASS\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"mfa-bypass\">How phishing kits bypass <em>MFA<\/em> in 2026<\/h2>\n\n  <p>Most organizations still treat multi-factor authentication as the last line of defense against credential theft. The assumption is intuitive: even if the adversary obtains the password, the second factor &mdash; OTP, push, SMS &mdash; blocks access. <strong>In 2026 that assumption is dangerously outdated.<\/strong><\/p>\n\n  <p>Phishing kits active today deploy <strong>Adversary-in-the-Middle (AiTM)<\/strong> reverse-proxy technology. Instead of a static copy of the login page, the kit inserts itself as a transparent relay between the victim and the real authentication service. The victim sees the genuine Microsoft 365, Google Workspace or banking portal. They enter the password. They complete MFA. In that instant the authenticated session token is captured &mdash; before it ever reaches the browser.<\/p>\n\n  <p>The result: the adversary walks into the tenant with a fully authenticated session. No brute-forcing. No password reuse. No MFA fatigue. Just a legitimate token, issued by your Identity Provider, now in the wrong hands.<\/p>\n\n  <!-- AiTM diagram -->\n  <div class=\"fg-flow\">\n    <svg viewBox=\"0 0 780 170\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"font-family:'IBM Plex Sans',system-ui,sans-serif;\">\n      <defs>\n        <marker id=\"arrNavy\" markerWidth=\"8\" markerHeight=\"6\" refX=\"8\" refY=\"3\" orient=\"auto\"><path d=\"M0,0 L8,3 L0,6Z\" fill=\"#0F1117\"\/><\/marker>\n        <marker id=\"arrRed\" markerWidth=\"8\" markerHeight=\"6\" refX=\"8\" refY=\"3\" orient=\"auto\"><path d=\"M0,0 L8,3 L0,6Z\" fill=\"#FF2E5C\"\/><\/marker>\n      <\/defs>\n      <text x=\"390\" y=\"16\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" letter-spacing=\"2\">AiTM ATTACK FLOW<\/text>\n      <!-- Victim -->\n      <rect x=\"12\" y=\"40\" width=\"140\" height=\"80\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1.5\"\/>\n      <rect x=\"12\" y=\"40\" width=\"140\" height=\"4\" fill=\"#0F1117\"\/>\n      <text x=\"82\" y=\"72\" text-anchor=\"middle\" fill=\"#0F1117\" font-size=\"13\" font-weight=\"600\">Victim<\/text>\n      <text x=\"82\" y=\"92\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">Enters credentials<\/text>\n      <text x=\"82\" y=\"106\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">+ completes MFA<\/text>\n      <line x1=\"152\" y1=\"80\" x2=\"228\" y2=\"80\" stroke=\"#0F1117\" stroke-width=\"2\" marker-end=\"url(#arrNavy)\"\/>\n      <text x=\"190\" y=\"70\" text-anchor=\"middle\" fill=\"#0F1117\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" font-weight=\"500\" letter-spacing=\"1\">CREDENTIALS<\/text>\n      <!-- Proxy -->\n      <rect x=\"230\" y=\"35\" width=\"160\" height=\"90\" fill=\"#07122A\"\/>\n      <rect x=\"230\" y=\"35\" width=\"160\" height=\"4\" fill=\"#22D3FF\"\/>\n      <text x=\"310\" y=\"68\" text-anchor=\"middle\" fill=\"#E6F0FF\" font-size=\"12\" font-weight=\"600\">AiTM Reverse<\/text>\n      <text x=\"310\" y=\"86\" text-anchor=\"middle\" fill=\"#22D3FF\" font-size=\"12\" font-weight=\"600\">Proxy<\/text>\n      <text x=\"310\" y=\"108\" text-anchor=\"middle\" fill=\"#8FA6C9\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">Intercepts the token<\/text>\n      <line x1=\"390\" y1=\"80\" x2=\"468\" y2=\"80\" stroke=\"#0F1117\" stroke-width=\"2\" marker-end=\"url(#arrNavy)\"\/>\n      <text x=\"429\" y=\"70\" text-anchor=\"middle\" fill=\"#0F1117\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" font-weight=\"500\" letter-spacing=\"1\">FORWARDED<\/text>\n      <!-- M365 -->\n      <rect x=\"470\" y=\"40\" width=\"140\" height=\"80\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1.5\"\/>\n      <rect x=\"470\" y=\"40\" width=\"140\" height=\"4\" fill=\"#0F1117\"\/>\n      <text x=\"540\" y=\"72\" text-anchor=\"middle\" fill=\"#0F1117\" font-size=\"13\" font-weight=\"600\">Microsoft 365<\/text>\n      <text x=\"540\" y=\"92\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">Issues auth token<\/text>\n      <!-- Stolen token -->\n      <line x1=\"390\" y1=\"140\" x2=\"668\" y2=\"140\" stroke=\"#FF2E5C\" stroke-width=\"2\" stroke-dasharray=\"5,3\" marker-end=\"url(#arrRed)\"\/>\n      <text x=\"529\" y=\"155\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" font-weight=\"600\" letter-spacing=\"1\">TOKEN STOLEN &rarr; FULL MAILBOX ACCESS<\/text>\n      <!-- Adversary -->\n      <rect x=\"670\" y=\"115\" width=\"100\" height=\"50\" fill=\"#f5f5f5\" stroke=\"#FF2E5C\" stroke-width=\"1.5\"\/>\n      <rect x=\"670\" y=\"115\" width=\"100\" height=\"4\" fill=\"#FF2E5C\"\/>\n      <text x=\"720\" y=\"140\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-size=\"11\" font-weight=\"600\">Adversary<\/text>\n      <text x=\"720\" y=\"155\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">Graph API<\/text>\n    <\/svg>\n  <\/div>\n\n  <div class=\"fg-operation\">\n    <div class=\"fg-operation-title\">\n      <svg width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" fill=\"none\"><circle cx=\"8\" cy=\"8\" r=\"6.5\" stroke=\"#FF2E5C\" stroke-width=\"1.6\"\/><line x1=\"8\" y1=\"4\" x2=\"8\" y2=\"8.5\" stroke=\"#FF2E5C\" stroke-width=\"1.6\" stroke-linecap=\"round\"\/><circle cx=\"8\" cy=\"11.5\" r=\"0.9\" fill=\"#FF2E5C\"\/><\/svg>\n      Critical finding\n    <\/div>\n    <p>Every AiTM phishing kit analyzed in this report bypasses OTP, SMS and push. <strong>Only phishing-resistant MFA (FIDO2 \/ passkeys)<\/strong> prevents token interception, because the cryptographic challenge is bound to the legitimate domain and cannot be relayed through a proxy.<\/p>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       2 \u00b7 M365 POST-COMPROMISE\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"m365-persistence\">Inside Microsoft 365: the <em>post-compromise<\/em> playbook<\/h2>\n\n  <p>What happens after the token is stolen is where the real damage occurs &mdash; and where most organizations are blind. The adversary does not read a few emails: they execute a precise, rehearsed sequence designed to maintain access, suppress alerts and monetize the compromise.<\/p>\n\n  <div class=\"fg-timeline\">\n    <div class=\"fg-timeline-item\">\n      <div class=\"fg-tl-date\">Phase 1<\/div>\n      <div class=\"fg-tl-title\">Inbox rule creation<\/div>\n      <div class=\"fg-tl-desc\">The adversary creates rules that automatically move or delete security notifications, password reset confirmations and suspicious-login alerts. Typical actions: <code>moveToDeletedItems<\/code>, <code>markAsRead<\/code>, keyword filters on &ldquo;security&rdquo;, &ldquo;unusual sign-in&rdquo;, &ldquo;password&rdquo;.<\/div>\n    <\/div>\n    <div class=\"fg-timeline-item\">\n      <div class=\"fg-tl-date\">Phase 2<\/div>\n      <div class=\"fg-tl-title\">Financial thread identification<\/div>\n      <div class=\"fg-tl-desc\">The adversary &mdash; or an automated AI pipeline &mdash; scans the mailbox for high-value conversations: invoices, wire-transfer instructions, vendor payment threads, contracts with outstanding payments. Keywords: &ldquo;bank details&rdquo;, &ldquo;IBAN&rdquo;, &ldquo;wire&rdquo;, &ldquo;invoice&rdquo;, &ldquo;payment due&rdquo;.<\/div>\n    <\/div>\n    <div class=\"fg-timeline-item\">\n      <div class=\"fg-tl-date\">Phase 3<\/div>\n      <div class=\"fg-tl-title\">BEC email generation<\/div>\n      <div class=\"fg-tl-desc\">The adversary writes a Business Email Compromise message that replies <em>inside<\/em> the existing conversation &mdash; same tone, same formatting, same signature. New bank details are provided. The recipient has no reason to suspect.<\/div>\n    <\/div>\n    <div class=\"fg-timeline-item\">\n      <div class=\"fg-tl-date\">Phase 4<\/div>\n      <div class=\"fg-tl-title\">Payroll redirect (targeted)<\/div>\n      <div class=\"fg-tl-desc\">In targeted attacks (Storm-2755 style), the adversary locates HR\/payroll systems accessible from the compromised account and alters direct-deposit details. Notifications are suppressed by inbox rules. The fraud may only surface at the next pay cycle.<\/div>\n    <\/div>\n  <\/div>\n\n  <div class=\"fg-assessment fg-assessment-red\">\n    <div class=\"fg-assessment-title\">Operational reading<\/div>\n    <p><strong>No malware is installed anywhere in this chain.<\/strong> The attack leverages legitimate authentication tokens, legitimate APIs and the victim&rsquo;s own infrastructure. Traditional endpoint protection and antivirus are completely blind.<\/p>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       3 \u00b7 PhaaS ECONOMY\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"phaas-economy\">Phishing-as-a-Service: the <em>rental economy<\/em> of cybercrime<\/h2>\n\n  <p>The most alarming development of 2026 is that running these attacks no longer requires any technical skill. The criminal ecosystem has reached full industrialization under the <strong>Phishing-as-a-Service (PhaaS)<\/strong> model. The aspiring adversary subscribes to a Telegram-based platform, logs into a management panel, and starts operating.<\/p>\n\n  <p>These are not crude tools. PhaaS platforms ship with real-time analytics dashboards, victim tracking, token management and &mdash; in EvilTokens&rsquo; case &mdash; integrated AI that automates the entire post-compromise chain through to BEC email generation. The entry barrier for sophisticated Business Email Compromise has collapsed: from years of expertise to a Telegram subscription and a few hundred euros.<\/p>\n\n  <div class=\"fg-stack\">\n    <div class=\"fg-stack-item\">\n      <div class=\"fg-stack-icon\">&#9673;<\/div>\n      <div class=\"fg-stack-name\">EvilProxy<\/div>\n      <div class=\"fg-stack-role\"><span class=\"fg-price\">&euro;400\/mo<\/span><\/div>\n      <div class=\"fg-stack-role\">900+ templates<\/div>\n    <\/div>\n    <div class=\"fg-stack-item\">\n      <div class=\"fg-stack-icon\">&#9733;<\/div>\n      <div class=\"fg-stack-name\">Rockstar 2FA<\/div>\n      <div class=\"fg-stack-role\"><span class=\"fg-price\">&euro;200\/2wk<\/span><\/div>\n      <div class=\"fg-stack-role\">2,000+ domains<\/div>\n    <\/div>\n    <div class=\"fg-stack-item\">\n      <div class=\"fg-stack-icon\">&#9881;<\/div>\n      <div class=\"fg-stack-name\">V3B PK<\/div>\n      <div class=\"fg-stack-role\"><span class=\"fg-price\">&euro;200&ndash;300\/mo<\/span><\/div>\n      <div class=\"fg-stack-role\">EU banking focus<\/div>\n    <\/div>\n    <div class=\"fg-stack-item\">\n      <div class=\"fg-stack-icon\">&#9679;<\/div>\n      <div class=\"fg-stack-name\">EvilGinx2<\/div>\n      <div class=\"fg-stack-role\" style=\"color: var(--ok); font-weight: 600;\">Open source<\/div>\n      <div class=\"fg-stack-role\">Foundation toolkit<\/div>\n    <\/div>\n  <\/div>\n\n  <div class=\"fg-infobox\">\n    <div class=\"fg-infobox-title\">The economic reality<\/div>\n    <ul>\n      <li><strong>Cost of attack:<\/strong> a PhaaS subscription with MFA bypass, admin panel and hosting runs &euro;200 to &euro;400 per month.<\/li>\n      <li><strong>Potential return:<\/strong> a single successful BEC on a wire transfer can yield six- to seven-figure sums.<\/li>\n      <li><strong>Scalability:<\/strong> one affiliate runs hundreds of concurrent campaigns, tuned by season and industry.<\/li>\n      <li><strong>Resilience:<\/strong> when infrastructure is taken down, the platform rotates domains and rebuilds &mdash; just like a legitimate SaaS.<\/li>\n    <\/ul>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       4 \u00b7 ARSENAL\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"kit-arsenal\">The 2026 phishing kit <em>arsenal<\/em><\/h2>\n\n  <p>Based on Fortgale&rsquo;s proprietary intelligence collected via Threat Intelligence Platform in Q1 2026, these are the kits operating at scale. MFA bypass is now a standard feature, not a differentiator.<\/p>\n\n  <div class=\"fg-table-wrap\">\n    <table class=\"fg-table\">\n      <thead>\n        <tr>\n          <th>Kit<\/th>\n          <th>MFA bypass<\/th>\n          <th>Price<\/th>\n          <th>Signature capability<\/th>\n          <th>Severity<\/th>\n        <\/tr>\n      <\/thead>\n      <tbody>\n        <tr>\n          <td><strong>EvilTokens<\/strong><\/td>\n          <td>Device Code Flow<\/td>\n          <td>Telegram sub<\/td>\n          <td>LLM-automated BEC<\/td>\n          <td class=\"fg-highlight-cell\">Critical<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>EvilProxy<\/strong><\/td>\n          <td>AiTM reverse proxy<\/td>\n          <td><span class=\"fg-price\">&euro;400\/mo<\/span><\/td>\n          <td>900+ templates, TOR panel<\/td>\n          <td class=\"fg-highlight-cell\">Critical<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Rockstar 2FA<\/strong><\/td>\n          <td>AiTM reverse proxy<\/td>\n          <td><span class=\"fg-price\">&euro;200\/2wk<\/span><\/td>\n          <td>3,700+ URLScan hits, 2,000 domains<\/td>\n          <td class=\"fg-highlight-cell\">Critical<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>FlowerStorm<\/strong><\/td>\n          <td>AiTM reverse proxy<\/td>\n          <td>Telegram sub<\/td>\n          <td>Rockstar 2FA successor (fork)<\/td>\n          <td class=\"fg-highlight-cell\">Critical<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>EvilGinx2<\/strong><\/td>\n          <td>AiTM reverse proxy<\/td>\n          <td>Open source<\/td>\n          <td>Foundation for many commercial kits<\/td>\n          <td><strong>High<\/strong><\/td>\n        <\/tr>\n        <tr>\n          <td><strong>BlackForce<\/strong><\/td>\n          <td>Man-in-the-Browser<\/td>\n          <td>Telegram sub<\/td>\n          <td>React-based, 9-step chain<\/td>\n          <td><strong>High<\/strong><\/td>\n        <\/tr>\n        <tr>\n          <td><strong>V3B PK<\/strong><\/td>\n          <td>Token intercept<\/td>\n          <td><span class=\"fg-price\">&euro;200&ndash;300<\/span><\/td>\n          <td>EU banking, C2 on Telegram<\/td>\n          <td><strong>High<\/strong><\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Tykit<\/strong><\/td>\n          <td>Multi-stage<\/td>\n          <td>Telegram sub<\/td>\n          <td>SVG delivery, Cloudflare Turnstile gate<\/td>\n          <td><strong>High<\/strong><\/td>\n        <\/tr>\n        <tr>\n          <td><strong>CoGUI \/ Darcula<\/strong><\/td>\n          <td>Browser profiling<\/td>\n          <td>Telegram sub<\/td>\n          <td>Anti-analysis fingerprinting, Chinese ops<\/td>\n          <td>Medium<\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       5 \u00b7 EVILTOKENS\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"eviltokens\">Report: EvilTokens &mdash; <em>LLM-automated<\/em> BEC<\/h2>\n\n  <p>EvilTokens marks a category shift in phishing infrastructure. It is the first documented PhaaS platform to integrate large language models into the post-compromise pipeline, compressing the time between token theft and active fraud from hours to minutes.<\/p>\n\n  <div class=\"fg-malware-detail\">\n    <div class=\"fg-malware-detail-header\">\n      <span class=\"fg-md-icon\">&#9679;<\/span>\n      <span class=\"fg-md-title\">EvilTokens<\/span>\n      <span class=\"fg-md-tag\">PhaaS &middot; AI-augmented<\/span>\n    <\/div>\n    <div class=\"fg-malware-detail-body\">\n      <p>Unlike traditional AiTM kits built on reverse proxies, EvilTokens abuses the <strong>OAuth device code flow<\/strong> &mdash; a legitimate authentication mechanism designed for browser-less devices (smart TVs, IoT). The kit serves phishing pages impersonating Adobe, DocuSign and Microsoft, tricking the victim into authorizing a device code: the outcome is not a password but an OAuth token.<\/p>\n      <p>Once the token is captured, EvilTokens injects it into an <strong>automated AI pipeline<\/strong>: chained LLMs access the mailbox via Microsoft Graph API, analyze the content to isolate high-value financial threads, and generate contextually accurate BEC emails ready for delivery. The entire chain &mdash; from token capture to lure-ready email &mdash; completes in <strong>under 5 minutes<\/strong>, with zero human intervention.<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"fg-flow\">\n    <svg viewBox=\"0 0 780 130\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"font-family:'IBM Plex Sans',system-ui,sans-serif;\">\n      <defs>\n        <marker id=\"etArrow\" markerWidth=\"8\" markerHeight=\"6\" refX=\"8\" refY=\"3\" orient=\"auto\"><path d=\"M0,0 L8,3 L0,6Z\" fill=\"#0F1117\"\/><\/marker>\n        <marker id=\"etArrowR\" markerWidth=\"8\" markerHeight=\"6\" refX=\"8\" refY=\"3\" orient=\"auto\"><path d=\"M0,0 L8,3 L0,6Z\" fill=\"#FF2E5C\"\/><\/marker>\n      <\/defs>\n      <text x=\"390\" y=\"16\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" letter-spacing=\"2\">EVILTOKENS ATTACK CHAIN<\/text>\n      <rect x=\"10\" y=\"30\" width=\"130\" height=\"65\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1\"\/>\n      <rect x=\"10\" y=\"30\" width=\"130\" height=\"3\" fill=\"#0F1117\"\/>\n      <text x=\"75\" y=\"58\" text-anchor=\"middle\" fill=\"#0F1117\" font-size=\"10\" font-weight=\"600\">Phishing lure<\/text>\n      <text x=\"75\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">Adobe \/ DocuSign<\/text>\n      <line x1=\"140\" y1=\"62\" x2=\"168\" y2=\"62\" stroke=\"#0F1117\" stroke-width=\"1.5\" marker-end=\"url(#etArrow)\"\/>\n      <rect x=\"170\" y=\"30\" width=\"130\" height=\"65\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1\"\/>\n      <rect x=\"170\" y=\"30\" width=\"130\" height=\"3\" fill=\"#0F1117\"\/>\n      <text x=\"235\" y=\"58\" text-anchor=\"middle\" fill=\"#0F1117\" font-size=\"10\" font-weight=\"600\">Device Code Flow<\/text>\n      <text x=\"235\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">OAuth bypass<\/text>\n      <line x1=\"300\" y1=\"62\" x2=\"328\" y2=\"62\" stroke=\"#FF2E5C\" stroke-width=\"1.5\" marker-end=\"url(#etArrowR)\"\/>\n      <rect x=\"330\" y=\"30\" width=\"130\" height=\"65\" fill=\"#07122A\"\/>\n      <rect x=\"330\" y=\"30\" width=\"130\" height=\"3\" fill=\"#FF2E5C\"\/>\n      <text x=\"395\" y=\"56\" text-anchor=\"middle\" fill=\"#E6F0FF\" font-size=\"10\" font-weight=\"600\">Token captured<\/text>\n      <text x=\"395\" y=\"76\" text-anchor=\"middle\" fill=\"#8FA6C9\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">Admin panel<\/text>\n      <line x1=\"460\" y1=\"62\" x2=\"488\" y2=\"62\" stroke=\"#FF2E5C\" stroke-width=\"1.5\" marker-end=\"url(#etArrowR)\"\/>\n      <rect x=\"490\" y=\"30\" width=\"130\" height=\"65\" fill=\"#07122A\"\/>\n      <rect x=\"490\" y=\"30\" width=\"130\" height=\"3\" fill=\"#FF2E5C\"\/>\n      <text x=\"555\" y=\"56\" text-anchor=\"middle\" fill=\"#E6F0FF\" font-size=\"10\" font-weight=\"600\">LLM pipeline<\/text>\n      <text x=\"555\" y=\"76\" text-anchor=\"middle\" fill=\"#8FA6C9\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">Mailbox scan<\/text>\n      <line x1=\"620\" y1=\"62\" x2=\"648\" y2=\"62\" stroke=\"#FF2E5C\" stroke-width=\"1.5\" marker-end=\"url(#etArrowR)\"\/>\n      <rect x=\"650\" y=\"30\" width=\"120\" height=\"65\" fill=\"#f5f5f5\" stroke=\"#FF2E5C\" stroke-width=\"1.5\"\/>\n      <rect x=\"650\" y=\"30\" width=\"120\" height=\"3\" fill=\"#FF2E5C\"\/>\n      <text x=\"710\" y=\"56\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-size=\"10\" font-weight=\"600\">BEC generated<\/text>\n      <text x=\"710\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8.5\">Ready to send<\/text>\n      <text x=\"390\" y=\"118\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-family=\"'JetBrains Mono',monospace\" font-size=\"10\" font-weight=\"600\" letter-spacing=\"1\">&lt; 5 MINUTES &middot; ZERO HUMAN INTERVENTION<\/text>\n    <\/svg>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       6 \u00b7 ROCKSTAR & FLOWERSTORM\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"rockstar-flowerstorm\">Report: Rockstar 2FA and <em>FlowerStorm<\/em><\/h2>\n\n  <p>Rockstar 2FA &mdash; an evolution of the DadSec kit &mdash; and its successor FlowerStorm are the most widely deployed AiTM platforms in the wild, with thousands of detected domains and a direct lineage between them.<\/p>\n\n  <p>Rockstar 2FA alone has generated more than <strong>3,700 URLScan hits<\/strong> and operates across more than <strong>2,000 registered domains<\/strong>. At <span class=\"fg-price\">&euro;200 \/ 2 weeks<\/span> it has attracted a wide affiliate base running concurrent campaigns. When its infrastructure was disrupted in late 2025, <strong>FlowerStorm<\/strong> emerged as its successor &mdash; sharing significant code overlap, identical field naming conventions and architecturally close backends.<\/p>\n\n  <div class=\"fg-evo-diagram\">\n    <svg viewBox=\"0 0 780 100\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"font-family:'IBM Plex Sans',system-ui,sans-serif;\">\n      <defs>\n        <marker id=\"evoArr\" markerWidth=\"10\" markerHeight=\"7\" refX=\"10\" refY=\"3.5\" orient=\"auto\"><path d=\"M0,0 L10,3.5 L0,7Z\" fill=\"#0369A1\"\/><\/marker>\n      <\/defs>\n      <rect x=\"20\" y=\"15\" width=\"200\" height=\"70\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1.5\"\/>\n      <rect x=\"20\" y=\"15\" width=\"200\" height=\"4\" fill=\"#0F1117\"\/>\n      <text x=\"120\" y=\"42\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" letter-spacing=\"1.5\">2024<\/text>\n      <text x=\"120\" y=\"60\" text-anchor=\"middle\" fill=\"#0F1117\" font-size=\"13\" font-weight=\"600\">DadSec<\/text>\n      <text x=\"120\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">Original platform<\/text>\n      <line x1=\"220\" y1=\"50\" x2=\"290\" y2=\"50\" stroke=\"#0369A1\" stroke-width=\"2\" marker-end=\"url(#evoArr)\"\/>\n      <rect x=\"292\" y=\"15\" width=\"200\" height=\"70\" fill=\"#f5f5f5\" stroke=\"#d0d0d0\" stroke-width=\"1.5\"\/>\n      <rect x=\"292\" y=\"15\" width=\"200\" height=\"4\" fill=\"#0369A1\"\/>\n      <text x=\"392\" y=\"42\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" letter-spacing=\"1.5\">2025<\/text>\n      <text x=\"392\" y=\"60\" text-anchor=\"middle\" fill=\"#0369A1\" font-size=\"13\" font-weight=\"600\">Rockstar 2FA<\/text>\n      <text x=\"392\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">3,700+ hits &middot; 2K domains<\/text>\n      <line x1=\"492\" y1=\"50\" x2=\"560\" y2=\"50\" stroke=\"#0369A1\" stroke-width=\"2\" marker-end=\"url(#evoArr)\"\/>\n      <rect x=\"562\" y=\"15\" width=\"200\" height=\"70\" fill=\"#f5f5f5\" stroke=\"#FF2E5C\" stroke-width=\"1.5\"\/>\n      <rect x=\"562\" y=\"15\" width=\"200\" height=\"4\" fill=\"#FF2E5C\"\/>\n      <text x=\"662\" y=\"42\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" letter-spacing=\"1.5\">2026<\/text>\n      <text x=\"662\" y=\"60\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-size=\"13\" font-weight=\"600\">FlowerStorm<\/text>\n      <text x=\"662\" y=\"76\" text-anchor=\"middle\" fill=\"#5A7099\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\">Fork &middot; active successor<\/text>\n    <\/svg>\n  <\/div>\n\n  <div class=\"fg-table-wrap\">\n    <table class=\"fg-table\">\n      <thead>\n        <tr>\n          <th>Attribute<\/th>\n          <th>Rockstar 2FA<\/th>\n          <th>FlowerStorm<\/th>\n        <\/tr>\n      <\/thead>\n      <tbody>\n        <tr>\n          <td><strong>MFA bypass<\/strong><\/td>\n          <td>AiTM reverse proxy<\/td>\n          <td>AiTM reverse proxy<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Price<\/strong><\/td>\n          <td><span class=\"fg-price\">&euro;200 \/ 2 weeks<\/span><\/td>\n          <td>Telegram sub<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Domains<\/strong><\/td>\n          <td>2,000+<\/td>\n          <td class=\"fg-highlight-cell\">Growing (post-Rockstar migration)<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Lineage<\/strong><\/td>\n          <td>DadSec evolution<\/td>\n          <td>Rockstar 2FA code fork<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Target sectors<\/strong><\/td>\n          <td>Finance, Healthcare, IT, Telco<\/td>\n          <td>Finance, Healthcare, Manufacturing<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Hosting<\/strong><\/td>\n          <td>Bulletproof + Cloudflare<\/td>\n          <td>Bulletproof + Cloudflare<\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       7 \u00b7 BLACKFORCE\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"blackforce\">Report: BlackForce &mdash; <em>Man-in-the-Browser<\/em><\/h2>\n\n  <p>BlackForce takes a different architectural route: instead of relaying traffic through a proxy, it operates as a <strong>Man-in-the-Browser (MitB)<\/strong> attack &mdash; injecting code directly into the browser session via a React application framework.<\/p>\n\n  <div class=\"fg-malware-detail\">\n    <div class=\"fg-malware-detail-header\">\n      <span class=\"fg-md-icon\">&#9670;<\/span>\n      <span class=\"fg-md-title\">BlackForce<\/span>\n      <span class=\"fg-md-tag\">MitB &middot; React-based<\/span>\n    <\/div>\n    <div class=\"fg-malware-detail-body\">\n      <p>BlackForce&rsquo;s attack chain unfolds across 9 steps: a multi-stage loader progressively drops the components, evading detection by fragmenting the payload. The React frontend imitates legitimate login portals with high fidelity, while the backend exfiltrates credentials and session data in real time.<\/p>\n      <p>Sequence: (1) lure delivery &rarr; (2) React SPA landing &rarr; (3) browser profiling and anti-analysis &rarr; (4) MitB JavaScript injection &rarr; (5) credential capture &rarr; (6) session hijack &rarr; (7) exfiltration to C2 &rarr; (8) cookie-based persistence &rarr; (9) redirect to the legitimate site.<\/p>\n    <\/div>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       8 \u00b7 INFRASTRUCTURE\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"infrastructure\">Keitaro TDS and Storm-2755: the phishing <em>infrastructure<\/em><\/h2>\n\n  <p>Behind every phishing campaign at scale sits infrastructure. In 2026 two elements stand out: <strong>Keitaro<\/strong> as the traffic management layer and <strong>Storm-2755<\/strong> as a case study in end-to-end orchestration.<\/p>\n\n  <div class=\"fg-profile\">\n    <div class=\"fg-profile-badge\">\n      <svg width=\"72\" height=\"72\" viewBox=\"0 0 72 72\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n        <rect x=\"1\" y=\"1\" width=\"70\" height=\"70\" fill=\"#07122A\" stroke=\"#d0d0d0\" stroke-width=\"2\"\/>\n        <text x=\"36\" y=\"30\" text-anchor=\"middle\" fill=\"#E6F0FF\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" font-weight=\"600\" letter-spacing=\"1.5\">TRAFFIC<\/text>\n        <text x=\"36\" y=\"46\" text-anchor=\"middle\" fill=\"#22D3FF\" font-family=\"'IBM Plex Sans',system-ui,sans-serif\" font-size=\"12\" font-weight=\"600\">TDS<\/text>\n        <line x1=\"18\" y1=\"52\" x2=\"54\" y2=\"52\" stroke=\"#5A7099\" stroke-width=\"0.5\"\/>\n        <text x=\"36\" y=\"63\" text-anchor=\"middle\" fill=\"#8FA6C9\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8\" letter-spacing=\"1\">KEITARO<\/text>\n      <\/svg>\n    <\/div>\n    <div class=\"fg-profile-info\">\n      <div class=\"fg-profile-name\">Keitaro TDS<\/div>\n      <div class=\"fg-profile-origin\">Type: Traffic Distribution System &nbsp;&middot;&nbsp; Origin: repurposed commercial AdTech<\/div>\n      <p class=\"fg-profile-desc\">Originally a legitimate AdTech product, Keitaro has been repurposed by Eastern European threat actors as the traffic management backbone for phishing operations. It provides automatic visitor routing by geolocation, browser and time of day; <strong>cloaking<\/strong> to hide malicious content from security crawlers; and conversion tracking to measure how many victims actually submitted credentials.<\/p>\n    <\/div>\n  <\/div>\n\n  <div class=\"fg-profile\">\n    <div class=\"fg-profile-badge\">\n      <svg width=\"72\" height=\"72\" viewBox=\"0 0 72 72\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n        <rect x=\"1\" y=\"1\" width=\"70\" height=\"70\" fill=\"#07122A\" stroke=\"#FF2E5C\" stroke-width=\"2\"\/>\n        <text x=\"36\" y=\"28\" text-anchor=\"middle\" fill=\"#E6F0FF\" font-family=\"'JetBrains Mono',monospace\" font-size=\"9\" font-weight=\"600\" letter-spacing=\"1.5\">ACTOR<\/text>\n        <text x=\"36\" y=\"46\" text-anchor=\"middle\" fill=\"#FF2E5C\" font-family=\"'IBM Plex Sans',system-ui,sans-serif\" font-size=\"11\" font-weight=\"600\">S-2755<\/text>\n        <line x1=\"18\" y1=\"52\" x2=\"54\" y2=\"52\" stroke=\"#5A7099\" stroke-width=\"0.5\"\/>\n        <text x=\"36\" y=\"63\" text-anchor=\"middle\" fill=\"#8FA6C9\" font-family=\"'JetBrains Mono',monospace\" font-size=\"8\" letter-spacing=\"1\">STORM<\/text>\n      <\/svg>\n    <\/div>\n    <div class=\"fg-profile-info\">\n      <div class=\"fg-profile-name\">Storm-2755<\/div>\n      <div class=\"fg-profile-origin\">Motivation: financial &nbsp;&middot;&nbsp; Technique: AiTM + payroll fraud<\/div>\n      <p class=\"fg-profile-desc\">A financially motivated threat actor that combines <strong>SEO poisoning and malvertising<\/strong> to funnel victims to a spoofed Microsoft 365 portal. The AiTM kit captures the token, bypasses MFA, and the adversary then navigates to HR\/payroll systems to reroute salaries. Inbox rules suppress notifications. No malware is used: the entire operation runs on legitimate tokens and APIs.<\/p>\n    <\/div>\n  <\/div>\n\n  <hr class=\"fg-divider\">\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       9 \u00b7 OPERATIONAL RECOMMENDATIONS\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <h2 id=\"defenses\">Operational <em>recommendations<\/em><\/h2>\n\n  <p>Based on Fortgale&rsquo;s analysis of active campaigns, these are the priority defensive measures. Each line has a window and a verifiable metric.<\/p>\n\n  <h3>Immediate (0&ndash;30 days)<\/h3>\n  <div class=\"fg-infobox\">\n    <div class=\"fg-infobox-title\">\n      <svg width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" fill=\"none\"><path d=\"M4 8l3 3 5-6\" stroke=\"#0369A1\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>\n      Priority actions\n    <\/div>\n    <ul>\n      <li><strong>Disable device code flow<\/strong> for non-privileged users in Azure AD \/ Entra ID &mdash; this removes the EvilTokens vector at the root.<\/li>\n      <li><strong>Migrate critical accounts to FIDO2\/passkeys<\/strong> &mdash; the only factor that resists AiTM interception, because the cryptographic challenge is bound to the domain.<\/li>\n      <li><strong>Enable OAuth token monitoring<\/strong> with alerts on tokens issued for non-approved applications or from unexpected geographies.<\/li>\n    <\/ul>\n  <\/div>\n\n  <h3>Short term (30&ndash;90 days)<\/h3>\n  <div class=\"fg-infobox\">\n    <div class=\"fg-infobox-title\">\n      <svg width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" fill=\"none\"><path d=\"M4 8l3 3 5-6\" stroke=\"#0369A1\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>\n      Hardening the operation\n    <\/div>\n    <ul>\n      <li><strong>Deploy DNS filtering<\/strong> with proactive blocking of known PhaaS IOCs &mdash; Fortgale&rsquo;s platform feeds provide continuously updated blocklists.<\/li>\n      <li><strong>Targeted awareness on social engineering lures<\/strong> &mdash; these techniques rely on user-initiated execution and cannot be stopped by technical controls alone.<\/li>\n      <li><strong>Brand monitoring<\/strong> for domain spoofing and malicious SEO positioning leveraging your organization&rsquo;s name.<\/li>\n    <\/ul>\n  <\/div>\n\n  <h3>Structural<\/h3>\n  <div class=\"fg-infobox\">\n    <div class=\"fg-infobox-title\">\n      <svg width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" fill=\"none\"><path d=\"M4 8l3 3 5-6\" stroke=\"#0369A1\" stroke-width=\"1.8\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg>\n      Long-term architecture\n    <\/div>\n    <ul>\n      <li><strong>Session anomaly detection<\/strong> for IP\/User-Agent mismatches on authenticated sessions &mdash; catches stolen tokens replayed from unexpected locations<\/li>\n      <li><strong>Out-of-band verification<\/strong> mandatory for any bank detail or payroll change in HR systems &mdash; Storm-2755 only works if no one picks up the phone<\/li>\n    <\/ul>\n  <\/div>\n\n  <!-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n       CTA CLOSING\n       \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 -->\n  <div class=\"fg-cta\">\n    <div class=\"fg-cta-kicker\">FORTGALE &middot; EUROPEAN MDR + SOVEREIGN THREAT INTELLIGENCE<\/div>\n    <div class=\"fg-cta-title\">Want to know who&rsquo;s <em>watching<\/em> your sector?<\/div>\n    <div class=\"fg-cta-sub\">The Fortgale sector report profiles by name the adversaries operating against your industry in Europe, the TTPs observed and the containment runbooks used by our senior analysts. One meeting. One NDA. One conversation with an analyst.<\/div>\n    <div class=\"fg-cta-links\">\n      <a class=\"fg-cta-link fg-cta-link-primary\" href=\"mailto:info@fortgale.com?subject=Request%20sector%20intelligence%20report\">Request the report<\/a>\n      <a class=\"fg-cta-link fg-cta-link-secondary\" href=\"https:\/\/fortgale.com\/it\/#contatti\/\">See a real runbook<\/a>\n    <\/div>\n  <\/div>\n\n<\/div>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Intelligence &middot; Phishing Kit &middot; Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced traditional defenses. MFA alone is not enough. The answer is not one more product but a managed defense that combines phishing-resistant authentication, session-level detection, intelligence-driven and AI triage. An attack is not [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":9778,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1497,2515],"tags":[269],"class_list":["post-9774","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-defence","category-featured","tag-phishing"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/9774","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=9774"}],"version-history":[{"count":11,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/9774\/revisions"}],"predecessor-version":[{"id":9792,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/9774\/revisions\/9792"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media\/9778"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=9774"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=9774"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=9774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}