Conventional phishing attacks rely on static replicas of login pages that security teams and anti-abuse groups routinely identify and shut down. A newly discovered phishing service, however, circumvents these defenses through an entirely different approach: it loads the actual target website live and functions as an intermediary, capturing the victim's login credentials, passwords, and MFA codes while simultaneously forwarding them to the legitimate service.
Phishing kits have long been available to aspiring attackers, but deploying them effectively demands technical expertise in managing servers, registering domains, obtaining certificates, configuring proxies, and handling other infrastructure tasks. Starkiller addresses this friction by automating the process: it dynamically retrieves the genuine login page, logs all user input, and relays information between the attacker's systems and the legitimate website.
According to research from Abnormal AI, Starkiller enables operators to choose a target organization—such as Apple, Facebook, Google, or Microsoft—and generates a deceptive link that mimics the legitimate domain while routing traffic through attacker-controlled servers. A Microsoft-focused phishing URL, for instance, might appear as "login.microsoft.com@[malicious/shortened URL here]." This technique exploits how browsers interpret the "@" symbol: everything preceding it is treated as username information, while the actual destination follows it.
When a victim clicks the phishing link, Starkiller deploys a Docker container with a headless Chrome instance that retrieves the real login page. As Abnormal researchers Callie Baron and Piotr Wojtyla explained, "The container then acts as a man-in-the-middle reverse proxy, forwarding the end user's inputs to the legitimate site and returning the site's responses. Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way."
The platform provides attackers with live session monitoring capabilities, enabling them to observe the target's activity in real time. Beyond basic credential theft, Starkiller incorporates keylogging, cookie and session token harvesting for direct account access, geographic tracking of victims, and automated Telegram notifications when credentials arrive. The service dashboard presents campaign metrics—visit counts, conversion rates, and performance graphs—resembling legitimate SaaS analytics tools.
Starkiller's handling of multi-factor authentication represents a particularly significant vulnerability. Because the victim authenticates directly with the legitimate service through the proxy, any MFA codes they submit are captured and forwarded in real time. Abnormal researchers noted that "The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account. When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed."
The service is operated by a threat group known as Jinkusu, which maintains a user forum where customers exchange techniques, request enhancements, and resolve technical issues. Additional features available à la carte include harvesting email addresses and contact information from compromised sessions for use in subsequent phishing campaigns.
Security researchers view Starkiller as a watershed moment in phishing evolution. By eliminating the need to maintain multiple phishing domains and circumventing traditional detection methods based on domain reputation and static page analysis, the service substantially reduces the technical barriers for less experienced attackers. Abnormal's analysis concludes that "Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling. Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach."
Source: Krebs on Security