Topic starter
27/06/2026 2:06 pm
TL;DR: Custom phishing panels for single brands now sell for hundreds of dollars, intercept 2FA and 3D Secure tokens in real time, and can alert attackers instantly when victims submit credentials, according to Abnormal AI. Static email gateways miss these bespoke campaigns, so behavioral detection becomes the practical control shift.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Custom Phishing Kits: How Cybercriminals Create Bespoke Brand Impersonation Attacks”.
By the numbers:
- Custom phishing panels targeting single brands sell for $600 to $999 on dark web forums.
- One custom phishing panel was priced at $750 for the package.
- The panel listing for Mobile.de starts at $600 for early buyers and rises to $999 for later ones.
Key questions
Q: What breaks when phishing panels can relay MFA codes in real time?
A: The assumption that a second factor creates durable proof of identity breaks down when the attacker can capture and reuse the code during the same session.
Q: Why do brand-specific phishing panels evade standard email security?
A: They evade standard email security because the email, landing page, and follow-on workflow are tailored to a single brand and no longer resemble the patterns static signatures are built to catch.
Q: How should security teams detect bespoke phishing campaigns?
A: Use behavioural signals across the full flow, not just message inspection.
Practitioner guidance
- Harden authentication against real-time relay Prioritise phishing-resistant authentication methods where the proof step is bound to the origin and session, not just a one-time code that can be replayed through a live panel.
- Tune detections for brand-specific lures Add behavioural models that score unusual sequence, timing, and interaction patterns across email, login, and transaction steps, especially when page branding looks normal.
- Correlate device and location signals Compare claimed user context with observed IP address, device type, and geography before allowing high-risk access or payment actions to proceed.
Bottom line: Brand-specific phishing panels compress the gap between social engineering and account takeover by making the fake session look like the real one until the factor is captured.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:44 pm
Brand fidelity has become a control problem, not just a social-engineering problem: when a counterfeit login flow reproduces the target brand’s exact prompts, the defender is no longer competing only with malicious email content. The real issue is that the user experience itself can be cloned closely enough to preserve trust through the critical moment of authentication. For IAM teams, that means phishing resistance now depends on whether the session can be verified after the user has already been convinced.
A few things that frame the scale:
- Tycoon 2FA alone accounted for 62% of phishing detected by Microsoft and over 64,000 confirmed incidents.
A question worth separating out:
Q: Why do MFA controls still fail against account takeover?
A: MFA reduces password-only compromise, but it does not stop attackers who steal session tokens, hijack browsers, or obtain access through adversary-in-the-middle phishing. Once the token is issued, the service often trusts it until expiry or revocation. That means organisations need continuous session control and behavioural detection, not just stronger login prompts.
👉 Read our full editorial: Brand-specific phishing panels are bypassing MFA in real time