Phishing Kit Evolution

Adversary-in-the-middle phishing kits proxy the legitimate login flow and relay credentials plus OTPs live.

Victims are lured through targeted copy, cloned landing pages, and domain variants that look correct at a glance.

These kits are increasingly sold as subscription offerings with dashboards and support.

Microsoft 365 and Google Workspace users

Remote teams and contractors

Consumers responding to account alerts and package texts

Session cookies stolen even after MFA entry.

Password reset prompts sent immediately after a fake admin alert.

Phishing-as-a-service operators selling customizable kits by brand.

Mailbox compromise often becomes the gateway to wider fraud.

Session theft can bypass traditional credential reset approaches.

Organizations face follow-on attacks from the same mailbox.

Adopt phishing-resistant MFA where possible.

Deploy email and web filtering against lookalike domains.

Train users on proxy-style phishing behavior.

Monitor session anomalies and impossible device changes.