Threat reportThreat IntelligenceTL-2026-1879
AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM) Phishing-as-a-Service Ecosystem — 2025-2026 Threat Landscape
AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM) (TL-2026-1879), also tracked as AiTM PhaaS Ecosystem, is a high-severity tracked intrusion set, first published 2026-08-04. It is attributed to Storm-1167 (Russia) with high confidence, affects Microsoft Microsoft 365 / Entra ID, maps to 18 MITRE ATT&CK techniques (T1027, T1056, T1059), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 2Storm-1167
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1879
- Threat ID
- TL-2026-1879
- Also known as
- AiTM PhaaS Ecosystem, AI-Phishing Threat Landscape, Phishing-as-a-Service Industrialization
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Storm-1167, GreyVibe
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government administration, military, finance, manufacturing, energy, construction, defense, health, technology, legal
- Target regions
- North America, Europe, ukraine, united kingdom, Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM)
Malware and tooling: Evilginx, FallSpy, LegionRelay, PhantomRelay, Starkiller, Tycoon 2FA
How AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM) works
AI-powered phishing and adversary-in-the-middle (AiTM) Phishing-as-a-Service (PhaaS) platforms have created an escalating threat landscape in 2025-2026. Over 10 major PhaaS platforms — including Tycoon 2FA, EvilProxy, NakedPages, FlowerStorm (Storm-1167), Sneaky 2FA, Starkiller, and Kali365 — serve hundreds of affiliates globally, targeting enterprises across finance, manufacturing, defense, energy, and government sectors. Concurrently, the Russia-linked GREYVIBE cluster conducts AI-enhanced espionage phishing against Ukrainian military and government targets, using ChatGPT, Gemini, and Ideogram to generate spear-phishing lures, custom obfuscators, and PowerShell RATs. These trends are driven by generative AI lowering the barrier to sophisticated phishing, the industrialization of MFA bypass via reverse-proxy AiTM kits, and the use of compromised aged domains and RDGA to evade detection.
The phishing landscape has undergone a fundamental transformation in 2025-2026, driven by two converging trends: the commoditization of adversary-in-the-middle (AiTM) phishing kits as a service, and the integration of generative AI across the entire phishing lifecycle.
## AiTM Phishing-as-a-Service (PhaaS) Ecosystem
At least 12 active PhaaS platforms now compete in a mature underground market, with subscription prices ranging from $100 to $1,000 per month. These platforms provide turnkey phishing infrastructure including email templates, attachment templates (HTML, SVG), anti-bot CAPTCHA gates, administration panels, and Telegram-based credential exfiltration. Sales occur primarily through Telegram channels and private groups, with some operators using Signal, Session, SimpleX, or Tox for operational security.
Sekoia's global analysis (January-April 2025) ranked Tycoon 2FA as the most prominent platform (4.8/5), followed by Storm-1167/FlowerStorm (4.2/5), NakedPages (4.0/5), Sneaky 2FA (3.6/5), EvilProxy (3.2/5), and Evilginx-ywnjb (3.2/5). Tycoon 2FA operates as a synchronous relay server with centralized infrastructure, registering dozens of new domains daily behind Cloudflare, with source code and anti-bot pages updated weekly. Storm-1167, tracked by Microsoft since June 2023, operates a large centralized PhaaS with hundreds of active affiliates. FlowerStorm (first seen June 2024) is assessed as a likely rebrand of the Rockstar 2FA platform after its disruption in 2024 and targets Microsoft 365 credentials.
Infoblox's analysis of a global procurement-themed AiTM campaign identified a single actor rotating between multiple PhaaS platforms — EvilProxy, FlowerStorm, and Kali365 — to maintain operational resilience. The campaign used compromised aged domains (average age >6 years, with one domain dormant for nearly a decade before serving malicious content in May 2026) for fake document download portals, CAPTCHA gates via Cloudflare Turnstile, and reverse-proxy AiTM pages that intercept credentials and MFA session tokens in real time. Lures were sent from previously compromised organizational accounts and themed around procurement (RFIs, bid invitations, shared project documentation) with fake deadlines and confidentiality language to pressure recipients.
JUMPSEC documented a parallel AiTM campaign targeting UK industrial sectors (manufacturing, construction, oil and gas, engineering), first detected February 27, 2025 and still active. This campaign used a commercially available AiTM kit deployed primarily on DigitalOcean infrastructure, with Cloudflare CAPTCHA gates, and exhibited a 12.3% daily average increase in observed results (from 184 on March 11 to 290 on March 27, 2025). The attackers' infrastructure blocks reconnaissance scans from Shodan and ZoomEye but allows Censys queries, providing a fingerprinting vector for defenders.
## Distribution Technique Evolution
Sekoia documented a clear evolution in phishing attachment distribution methods: QR codes in documents dominated in 2023, followed by HTML attachments in 2024, and a surge in SVG attachments from late 2024 through April 2025. SVG files contain either embedded JavaScript or xlink:href attributes to redirect to the AiTM proxy chain. Several PhaaS providers now offer ready-to-use SVG and HTML attachment templates as part of their subscription packages. Traffic Distribution Systems (TDS) — such as BlackTDS (Tycoon 2FA) and Adspect TDS (Mamba 2FA) — filter bot traffic and researchers before victims reach the phishing page.
## GREYVIBE: AI-Enhanced State-Aligned Phishing Operations
GREYVIBE, a Russia-linked threat cluster active since August 2025, represents the most documented case of systematic AI integration across the phishing lifecycle. Active in 2026, the group operates five parallel attack chains (PhantomMail, PhantomClick, PrincessClub, DroneLink, Nebo) targeting Ukrainian military personnel, government agencies, and civilian infrastructure. They use ChatGPT, Google Gemini, and Ideogram AI to generate spear-phishing lures, construct fake websites (adult club sites, drone charity portals, counterfeit Russian military login portals), develop custom AI-generated obfuscators (LOOKVALJS, DAYLIGHT, TEASOUP, LOOKVALPS), and deploy PowerShell RATs (PhantomRelay, LegionRelay) and Android spyware (FallSpy). Their AI-generated code exhibits non-idiomatic variable naming and redundant logic structures — a fingerprint that can aid detection. The group's OPSEC weaknesses include testing samples in public sandboxes, misconfigured access controls exposing backend operations, and co-located crypto-mining.
## AiTM MFA Bypass Mechanisms
Modern AiTM kits operate as synchronous reverse proxies that sit between the victim and the legitimate authentication service. When a victim enters credentials and completes MFA, the proxy relays the request in real time to the legitimate service while intercepting the resulting session cookies and authentication tokens. This allows attackers to establish authenticated sessions without needing to reverse-engineer or bypass MFA protocols. The Starkiller platform (documented March 2026 by CSA) industrializes this approach by running headless Chrome browsers inside Docker containers as proxy instances, defeating SMS OTPs, TOTP authenticator apps, and push notifications. CISA, NSA, and NIST classify FIDO2/passkeys as the only phishing-resistant MFA because cryptographic responses are bound to the legitimate origin domain, making them immune to proxy-based AiTM attacks.
## Implications for Defenders
The convergence of AI-generated content and commoditized PhaaS infrastructure means defenders face an adversary that can regenerate lures and infrastructure in hours, not weeks. Traditional signature-based detection fails against polymorphic AiTM kits with weekly code updates and AI-generated obfuscators. Detection strategies must shift to behavior-based analytics (authentication log inconsistencies, anomalous User-Agent/Application ID pairings), infrastructure tracking (Censys scanning for kit signatures, urlscan.io monitoring), and adoption of phishing-resistant authentication (FIDO2/WebAuthn). The GREYVIBE campaign demonstrates that AI-assisted attribution challenges are real — LLM-generated code with no historical backlinks erodes traditional TTP-based attribution methodologies.
MITRE ATT&CK techniques used in TL-2026-1879
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
Initial Access
T1078 Valid Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Discovery
T1082 System Information Discovery
Collection
Persistence
T1505 Server Software Component
credential-access
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1586 Compromise Accounts
Affected products and versions in AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM)
- Microsoft — Microsoft 365 / Entra ID
Vulnerable versions: All versions with legacy MFA (SMS, TOTP, push notifications) - Google — Google Workspace
Vulnerable versions: All versions with legacy MFA - Cloudflare — Turnstile (abused by attackers)
Vulnerable versions: Turnstile deployed as CAPTCHA gate on AiTM phishing pages - DigitalOcean — Cloud Hosting (abused by attackers)
Vulnerable versions: DigitalOcean infrastructure used to host AiTM proxy servers
Remediation for AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM)
Immediate actions
- Deploy FIDO2/WebAuthn passkeys as phishing-resistant MFA for all accounts, prioritizing privileged users
- Configure Microsoft Entra ID Conditional Access policies to block authentication from untrusted locations and anomalous User-Agent strings
- Implement Entra ID Authentication Strengths to require passkey-based authentication for high-risk roles
- Block SVG and HTML attachments at email gateway where not business-required
- Conduct retrospective log analysis for authentication events from known AiTM hosting ranges (DigitalOcean, 5.230.0.0/16, 134.199.0.0/16)
Workarounds
- Restrict cloud file-sharing services (Google Drive, 4sync, Gamma.app) for external file reception
- Enforce WebAuthn for all administrative and privileged accounts
- Implement email banner warnings for external senders and impersonation alerts
- Block known PhaaS infrastructure domains at DNS level
- Disable legacy authentication protocols (IMAP, POP, SMTP AUTH) for all users
Longer-term hardening
- Adopt passwordless authentication (Windows Hello for Business, FIDO2 security keys) enterprise-wide
- Deploy behavioral analytics for anomalous authentication patterns (User-Agent inconsistencies, geolocation jumps)
- Implement AI-based phishing detection with NLP analysis of email content for LLM-generated indicators
- Establish baseline of approved file-sharing services with anomaly detection
- Monitor Censys and urlscan.io for AiTM kit signatures before active deployment against the organization
Timeline of AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM)
- EvilProxy first offered for sale on the Exploit forum, later expanding to XSS (July 2022) and Telegram. It originated the Phishing-as-a-Service and reverse-proxy marketing terms.
- NakedPages and Greatness PhaaS platforms launch on Telegram. NakedPages operates as a decentralized reverse-proxy service with ~220 active servers and an estimated 150-250 customers.
- Microsoft Threat Intelligence first reports Storm-1167, a threat actor operating a large centralized AiTM PhaaS platform with hundreds of affiliates. The actor remains among the top-3 most prominent PhaaS operators through 2025-2026.
- Dadsec OTT AiTM platform rebranded as Rockstar 2FA following analysis and disruption efforts. Rockstar 2FA had become the top phishing page platform by late 2023.
- FlowerStorm first observed, assessed as a rebrand of the disrupted Rockstar 2FA platform. Targets Microsoft 365 credentials using reverse-proxy AiTM techniques. Associated with Storm-1167 by Infoblox.
- JUMPSEC detects an AiTM phishing campaign targeting UK industrial sectors (manufacturing, construction, oil and gas, engineering). The campaign uses a commercially available AiTM kit deployed on DigitalOcean, with Cloudflare CAPTCHA gates and Shodan/ZoomEye blocking.
- The UK industrial AiTM campaign grows from 184 observed results (March 11) to 290 (March 27), a 12.3% daily average increase. JUMPSEC identifies 219 unique IP addresses associated with the campaign infrastructure.
- GREYVIBE, a Russia-linked threat cluster, first observed conducting AI-enhanced espionage operations against Ukrainian military, government, civilian, and business targets. The group uses ChatGPT, Google Gemini, and Ideogram AI across the full attack lifecycle.
- Cloud Security Alliance publishes research on Starkiller, a commercially operated PhaaS platform that uses headless Chrome browsers inside Docker containers as AiTM proxy instances, defeating SMS OTPs, TOTP authenticator apps, and push notifications.
- Kali365 PhaaS platform first observed, introducing device code abuse combined with AiTM session capture. Operates on a tiered reseller and affiliate model with low technical barrier to entry.
- Infoblox reports that the global procurement-themed AiTM campaign uses compromised aged domains (average age >6 years). Domain testserveren.com sat dormant for nearly a decade before serving malicious content. The same actor rotates between EvilProxy, FlowerStorm, and Kali365 platforms.
- Current threat landscape assessment: AiTM PhaaS ecosystem remains highly active with 12+ competing platforms. SVG attachments dominate distribution. GREYVIBE continues operations against Ukraine. CISA, NSA, and NIST continue to recommend FIDO2/passkeys as the only phishing-resistant MFA.
Sources cited for AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM)
- Infoblox — The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions
- JUMPSEC — UK Industrial Sector AiTM Phishing Campaign
- Sekoia — Global Analysis of Adversary-in-the-Middle Phishing Threats (Jan–Apr 2025)
- Cloud Security Alliance — Starkiller PhaaS Platform Research Note
- Hunter Strategy — GREYVIBE: Russia-Linked AI-Enhanced Multi-Vector Attacks Against Ukraine
- WithSecure Labs — GREYVIBE Threat Actor Analysis
- Cloud Security Alliance — GREYVIBE: Anatomy of an AI-Enhanced Nation-State Campaign
- JUMPSEC Labs — AiTM IOC Repository (GitHub)
- KnowBe4 — What AI Can't Hide When It Writes a Phishing Email
- CISA — Known Exploited Vulnerabilities Catalog
- Decryption Digest — AiTM Phishing and MFA Bypass Defense Guide 2026
- Cybersecurity News — How Top SOCs Detect and Stop AI Phishing That Beats Email Gateways
- CISecurity — Cyber Threat Actors Using AiTM Phishing
- PlanetJon — CodeStorm AiTM Campaign Targeting Microsoft 365
Detection coverage for TL-2026-1879
As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1879 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.