Phishing-as-a-service (PhaaS) platforms rent out complete credential theft operations, so a low-skilled criminal can bypass one-time-code MFA against Microsoft 365 or Google accounts for a subscription of a few hundred US dollars. Kits such as Tycoon 2FA, Rockstar 2FA and darcula supply lure templates, hosting, anti-bot filtering, real-time relay of MFA codes and session cookies, and Telegram bots that deliver stolen credentials within seconds. Because the same kit serves hundreds of customers, defenders face industrial volumes of near-identical attacks rather than a few skilled adversaries. This guide explains how the PhaaS model works, profiles the main platforms as reported by researchers, covers what disruption has and has not achieved, and sets out the controls and detections that hold up. It is for security operations, email security and identity teams. For the relay technique itself, read the AiTM Phishing Guide first.
Key takeaways
- PhaaS is a subscription business. Sekoia reports adversary-in-the-middle kits typically cost about US$100 to US$1,000 a month, sold and supported through Telegram channels with crypto payment bots.
- One-time codes no longer stop these kits. Relay-based platforms capture the password, the code and the resulting session cookie, which is why CISA lists app OTP and push as vulnerable to phishing.
- Takedowns help but do not end the threat. Microsoft reports Tycoon2FA activity fell 95% from its November 2025 peak after a March 2026 disruption, yet competing kits and rebrands are ready to absorb customers.
- Delivery hides behind trusted services. Campaigns send from compromised accounts and email marketing platforms, gate pages with CAPTCHA challenges, and move to QR codes, SMS, RCS and iMessage to avoid email filters.
- Phishing-resistant authentication and token binding are the durable fix. FIDO2 and passkeys break the relay; Conditional Access, token protection and session monitoring limit the damage when a weaker method is still allowed.
How the phishing-as-a-service model works
A PhaaS operator builds and maintains the phishing kit and its infrastructure, then sells access to affiliates who choose targets and send lures. The model mirrors ransomware-as-a-service: specialisation lowers the skill needed to attack and spreads the operator's development cost across many customers.
| Component | What the platform provides | What the affiliate does |
|---|---|---|
| Templates | Login page clones for Microsoft 365, Google, banks, postal services and other brands; darcula offered about 200 templates for brands in more than 100 countries, per Netcraft | Picks the brand and lure theme |
| Relay engine | Synchronous relay or reverse proxy that forwards credentials and MFA codes to the real service and captures the session cookie | Uses captured sessions for account takeover |
| Evasion | CAPTCHA gates (Cloudflare Turnstile, reCAPTCHA, hCaptcha), device fingerprinting, traffic distribution systems, obfuscated and randomised page code | Rotates domains when they are blocked |
| Delivery aids | Link and attachment generators, QR code generation, SMS and messaging tooling in some kits | Supplies mailing lists, compromised senders or SIM and device farms |
| Operations panel | Dashboard of visits, blocked bots and valid accounts; Telegram bot notifications | Monitors results and sells or uses access |
| Support and billing | Telegram channels, crypto payments, updates and customer support | Renews the subscription |
The relay step maps to ATT&CK T1557 Adversary-in-the-Middle, T1111 Multi-Factor Authentication Interception and T1539 Steal Web Session Cookie. Delivery maps to T1566.002 Spearphishing Link and T1566.001 Spearphishing Attachment, and preparation to T1583.001 Domains and T1608.005 Link Target. SMS and messaging lures on phones map to the mobile technique T1660 Phishing. Initial access brokers who resell the resulting sessions are a sign of T1650 Acquire Access on the buying side.
Platforms reported by researchers
Kit names change through rebrands, forks and code reuse, so treat the table as a snapshot of published research, not a complete list.
| Platform | First reported | Main targets and channel | Points from published research |
|---|---|---|---|
| Tycoon 2FA | Late 2023 (Sekoia) | Microsoft 365 and Google accounts by email, often with QR codes | Ranked first by Sekoia for January to April 2025; partly reuses Dadsec code; Cloudflare-fronted domains and weekly anti-bot changes. Targeted in a March 2026 disruption led by Microsoft with law enforcement and industry partners |
| Rockstar 2FA | Late 2023 (LevelBlue SpiderLabs, Sekoia) | Microsoft 365 by email | Updated version of the Dadsec and Phoenix kits; US$200 for two weeks; sold on ICQ, Telegram and Mail.ru; Telegram channel above 1,500 subscribers in August 2024; Turnstile-gated landing pages |
| Dadsec OTT | May 2023 (Sekoia) | Microsoft 365 | One of the most popular phishing page platforms by end of 2023; code base for later kits |
| EvilProxy | August 2020 (Sekoia) | Microsoft and Google accounts | Reverse-proxy model sold on criminal forums then Telegram; about 280 active servers on average |
| Mamba 2FA, Sneaky 2FA, Saiga 2FA | 2023 to 2024 (Sekoia) | Microsoft 365 | Synchronous relay kits; Sneaky 2FA detections rose sharply in early 2025 |
| darcula | Reported March 2024 (Netcraft) | Consumers by SMS, RCS and iMessage; postal, utility, bank, tax, airline and telecom brands | Chinese-language platform sold by monthly subscription; Netcraft detected over 20,000 related domains on about 11,000 IP addresses and roughly 120 new domains a day in early 2024 |
Not every service relays a login page. Some campaigns abuse legitimate sign-in flows instead, such as the OAuth device authorisation grant, where the victim types a code into the real Microsoft page and hands the attacker a token; relay-focused detections will miss these. See the Device Code Phishing Guide. Others target phone conversations rather than web pages; see the Callback Phishing (TOAD) Guide.
Rockstar and Tycoon show why tracking families matters more than tracking names: both build on Dadsec code, so detections written for one often catch the others. See the Vishing and Smishing Guide for consumer and mobile lures.
Disruption and takedowns: what they achieve
- Infrastructure disruption works for a while: Microsoft's Digital Defense Report 2026 says the March 2026 action against Tycoon2FA shut down servers that rendered pages and intercepted credentials. By June 2026 activity was down 95% from its November 2025 peak and its share of CAPTCHA-gated phishing fell from 76% to 12%.
- Customers move: because affiliates rent rather than build, they can switch to a competing kit quickly. Sekoia's ranking already showed several kits with hundreds of affiliates each.
- Rebrands are common: Dadsec, Phoenix and Rockstar show a single code base surviving under new names.
- Defender takeaway: treat a takedown as a window to tighten authentication, not as a fix. Keep indicators from disrupted kits in hunting for older compromises, because stolen sessions may already be in use.
For how disruption fits the wider intelligence picture, see the Threat Intelligence Guide.
Defences that hold up
Choosing authentication
| Method | Against relay PhaaS kits | CISA classification |
|---|---|---|
| FIDO2 security keys and passkeys (WebAuthn) | Resists: the credential is bound to the real site's origin, so the proxy cannot use it | Phishing-resistant |
| Smart cards and certificate-based authentication | Resists where the certificate check is bound to the genuine service | Phishing-resistant (less widely available) |
| Push with number matching | Fails: the victim approves a prompt triggered by the relay | Vulnerable to phishing; resists push bombing |
| Authenticator app or hardware OTP codes | Fails: codes are relayed in real time | Vulnerable to phishing |
| SMS or voice codes | Fails, and adds SIM swap risk | Last resort only |
Layered controls
- Conditional Access: require phishing-resistant authentication strength for administrators and high-risk roles first, then all users. Require compliant or managed devices for sensitive apps so a session replayed from attacker infrastructure fails the device check. See the Conditional Access Guide.
- Token binding: Microsoft Entra token protection makes Entra ID accept only device-bound session tokens for supported native apps (Exchange Online, SharePoint Online, Teams); browser support is still in preview. See the Token and Session Security Guide.
- Email authentication and filtering: the NCSC recommends DMARC, SPF and DKIM, server-side filtering that honours senders' DMARC policies, and limiting public information about staff.
- Link and QR inspection: rewrite and detonate links at click time, scan images and PDFs for QR codes, and block newly registered domains where your gateway supports it.
- Reporting culture: one-click reporting with fast feedback; the NCSC advises against blaming users who click and suggests measuring reports, not only clicks.
- Browser controls: enterprise browser protections and DNS filtering block known kit domains quickly. See the Enterprise Browser and Browser Security Guide.
Decision guidance
- Small organisations: start with passkeys or security keys for administrators and finance staff, turn on built-in mailbox protection and DMARC at p=quarantine or stronger, and use the identity provider's risk-based sign-in policies.
- Large organisations: roll out phishing-resistant authentication in rings, add device compliance and token protection, and run detection on sign-in telemetry in the SIEM.
- Consumer-facing brands: darcula-style smishing abuses your brand to reach your customers. Monitor lookalike domains, publish how you contact customers, and use takedown services.
How to implement
- Baseline exposure: list every authentication method allowed per user group and identify accounts still using SMS, OTP or push only.
- Protect privileged and high-value users first: issue security keys or passkeys to administrators, executives, finance and helpdesk. Create a Conditional Access policy for them in report-only mode, review sign-in logs, then enforce.
- Pilot ring for all staff: enrol a pilot department in passkeys, with a recovery process that itself cannot be phished (in-person or verified video identity check).
- Add device and token controls: require compliant devices for email and file access; enable token protection in report-only mode, then enforce for supported apps.
- Tighten mail flow: move DMARC to enforcement, enable QR code scanning and time-of-click protection, and block automatic external forwarding.
- Detect and respond: deploy the detections below and a playbook to revoke sessions, reset credentials and remove attacker MFA methods and inbox rules.
- Roll back safely: keep a documented exception group and a break-glass account excluded from new policies so a misconfiguration cannot lock out administrators; remove exceptions on a schedule.
Responding to a PhaaS compromise
A relay kit gives the attacker a live session, so speed matters more than root cause analysis in the first hour.
- Revoke sessions and refresh tokens for the affected user in the identity provider, then reset the password. Revocation without a reset, or a reset without revocation, leaves a gap.
- Remove persistence: delete authentication methods registered since the phishing click, inbox rules and forwarding created by the attacker, and OAuth grants to unfamiliar applications.
- Scope the blast radius: search the email platform for the same lure, sender, URL or QR image and purge copies; check sign-in logs for other users who reached the same landing domain.
- Look for the next stage: review sent items and Teams or chat messages for internal phishing from the compromised account, and finance mailboxes for changed payment details, the business email compromise pattern LevelBlue warns follows these kits.
- Block and share: block the landing and relay domains at the mail gateway, proxy and DNS, and report them to the hosting provider and national reporting services so takedown can begin.
- Close the gap: move the affected user, and their peer group, to phishing-resistant authentication before closing the case.
The Email Identity and BEC Guide covers the payment fraud follow-on in more depth.
Detection and measurement
| Signal | Source | Why it points to PhaaS |
|---|---|---|
| Successful sign-in from a hosting provider ASN shortly after a user clicked a link | Identity provider sign-in logs joined with email click logs | Relay servers sit in cloud or VPS hosting |
| Same session used from two distant IPs within minutes | Sign-in logs, risk detections such as anomalous token or impossible travel | Cookie replay after capture |
| New MFA method registered right after a risky sign-in | Directory audit log | Attacker persistence on the account |
| New inbox rules moving or deleting mail, or forwarding externally | Mailbox audit log | Hides replies and enables business email compromise (T1114.003) |
| Clicks on links behind CAPTCHA pages hosted on newly registered domains | Secure email gateway, proxy and DNS logs | Kits gate pages with Turnstile and similar challenges; LevelBlue notes Turnstile itself is legitimate, so combine signals |
| Spike in internal emails with document-share or e-signature lures from a known sender | Email security logs | Compromised accounts used as the next delivery channel |
Metrics
- Phishing-resistant coverage: percentage of users and of privileged users who can only sign in with FIDO2, passkeys or certificates.
- Exposure window: median time from first malicious click to session revocation.
- Report rate: percentage of a phishing campaign's recipients who reported it, and time to first report.
- Persistence found: number of attacker-registered MFA methods or inbox rules discovered per month.
- DMARC posture: percentage of your sending domains at enforcement.
Where identity fits
PhaaS kits sell identities, not malware. A captured session cookie lets the buyer act as the user, register new MFA methods and grant OAuth consent to malicious applications, which then persist after a password reset. Review consented applications and service principals on any account that was phished, and restrict user consent to verified publishers. See the Account Takeover Prevention Guide.
Framework mapping
| Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ATT&CK mitigation |
|---|---|---|---|
| Phishing-resistant MFA | IA-2 | PR.AA-03 | M1032 Multi-factor Authentication |
| Mail filtering and link protection | SI-8, SC-7 | DE.CM-09 | M1054 Software Configuration |
| Awareness and reporting | AT-2 | PR.AT-01 | M1017 User Training |
| Sign-in monitoring and containment | SI-4, AU-6 | DE.CM-03, RS.MI-01 | Not applicable |
Common failure patterns
- Treating any MFA as enough: the 0ktapus campaign relayed one-time codes through a Telegram bot. See the Twilio Breach 2022 page; Twilio moved staff to FIDO2 keys afterwards.
- Resetting the password only: the stolen session, a newly registered MFA method or an inbox rule survives a password reset. Revoke sessions and review methods every time.
- Blocking on sender reputation: Rockstar 2FA campaigns used compromised accounts and marketing platforms, so trusted senders still deliver kits.
- Ignoring phones: QR codes and RCS or iMessage lures move the click to an unmanaged device outside proxy and EDR coverage.
- Assuming a takedown ended the campaign: affiliates move to the next kit within days.
- A phishable recovery path: a passkey rollout undone by helpdesk resets based on knowledge questions. See the MFA Fatigue and Bypass Guide.
Practitioner checklist
- Require phishing-resistant authentication for all privileged and high-value users.
- Plan and track the retirement of SMS, voice and OTP-only sign-in for everyone else.
- Require compliant devices and enable token protection for supported apps.
- Enforce DMARC on all sending domains and turn on QR code and time-of-click link scanning.
- Block automatic external forwarding and alert on new inbox rules.
- Correlate email clicks with sign-ins from hosting ASNs and alert on new MFA registrations after risky sign-ins.
- Run a phished-account playbook: revoke sessions, reset password, remove attacker MFA methods, rules and OAuth grants.
- Make the account recovery process phishing resistant.
- Feed published kit indicators into hunting, including for disrupted kits.
Standards and references
- CISA: Implementing Phishing-Resistant MFA
- NCSC: Phishing Attacks, Defending Your Organisation
- MITRE ATT&CK: Adversary-in-the-Middle (T1557)
- Microsoft Learn: Token Protection in Conditional Access
- Microsoft: Digital Defense Report
- Sekoia: Global Analysis of Adversary-in-the-Middle Phishing Threats
- LevelBlue SpiderLabs: Rockstar 2FA, a Driving Force in Phishing-as-a-Service
- Netcraft: darcula Smishing Attacks Target Postal Services
Related NHI Mgmt Group resources: AiTM Phishing Guide · Passwordless and Passkeys Guide · Token and Session Security Guide · Phishing Guide