# AI-Enhanced Phishing and Adversary-in-the-Middle (AiTM) Phishing-as-a-Service Ecosystem — 2025-2026 Threat Landscape

> AI-powered phishing and adversary-in-the-middle (AiTM) Phishing-as-a-Service (PhaaS) platforms have created an escalating threat landscape in 2025-2026. Over 10 major PhaaS platforms — including Tycoon 2FA, EvilProxy, NakedPages, FlowerStorm (Storm-1167), Sneaky 2FA, Starkiller, and Kali365 — serve hundreds of affiliates globally, targeting enterprises across finance, manufacturing, defense, energy, and government sectors. Concurrently, the Russia-linked GREYVIBE cluster conducts AI-enhanced espionage phishing against Ukrainian military and government targets, using ChatGPT, Gemini, and Ideogram to generate spear-phishing lures, custom obfuscators, and PowerShell RATs. These trends are driven by generative AI lowering the barrier to sophisticated phishing, the industrialization of MFA bypass via reverse-proxy AiTM kits, and the use of compromised aged domains and RDGA to evade detection.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1879
- **ID:** TL-2026-1879
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Storm-1167 (Russia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The phishing landscape has undergone a fundamental transformation in 2025-2026, driven by two converging trends: the commoditization of adversary-in-the-middle (AiTM) phishing kits as a service, and the integration of generative AI across the entire phishing lifecycle.

## AiTM Phishing-as-a-Service (PhaaS) Ecosystem

At least 12 active PhaaS platforms now compete in a mature underground market, with subscription prices ranging from $100 to $1,000 per month. These platforms provide turnkey phishing infrastructure including email templates, attachment templates (HTML, SVG), anti-bot CAPTCHA gates, administration panels, and Telegram-based credential exfiltration. Sales occur primarily through Telegram channels and private groups, with some operators using Signal, Session, SimpleX, or Tox for operational security.

Sekoia's global analysis (January-April 2025) ranked Tycoon 2FA as the most prominent platform (4.8/5), followed by Storm-1167/FlowerStorm (4.2/5), NakedPages (4.0/5), Sneaky 2FA (3.6/5), EvilProxy (3.2/5), and Evilginx-ywnjb (3.2/5). Tycoon 2FA operates as a synchronous relay server with centralized infrastructure, registering dozens of new domains daily behind Cloudflare, with source code and anti-bot pages updated weekly. Storm-1167, tracked by Microsoft since June 2023, operates a large centralized PhaaS with hundreds of active affiliates. FlowerStorm (first seen June 2024) is assessed as a likely rebrand of the Rockstar 2FA platform after its disruption in 2024 and targets Microsoft 365 credentials.

Infoblox's analysis of a global procurement-themed AiTM campaign identified a single actor rotating between multiple PhaaS platforms — EvilProxy, FlowerStorm, and Kali365 — to maintain operational resilience. The campaign used compromised aged domains (average age >6 years, with one domain dormant for nearly a decade before serving malicious content in May 2026) for fake document download portals, CAPTCHA gates via Cloudflare Turnstile, and reverse-proxy AiTM pages that intercept credentials and MFA session tokens in real time. Lures were sent from previously compromised organizational accounts and themed around procurement (RFIs, bid invitations, shared project documentation) with fake deadlines and confidentiality language to pressure recipients.

JUMPSEC documented a parallel AiTM campaign targeting UK industrial sectors (manufacturing, construction, oil and gas, engineering), first detected February 27, 2025 and still active. This campaign used a commercially available AiTM kit deployed primarily on DigitalOcean infrastructure, with Cloudflare CAPTCHA gates, and exhibited a 12.3% daily average increase in observed results (from 184 on March 11 to 290 on March 27, 2025). The attackers' infrastructure blocks reconnaissance scans from Shodan and ZoomEye but allows Censys queries, providing a fingerprinting vector for defenders.

## Distribution Technique Evolution

Sekoia documented a clear evolution in phishing attachment distribution methods: QR codes in documents dominated in 2023, followed by HTML attachments in 2024, and a surge in SVG attachments from late 2024 through April 2025. SVG files contain either embedded JavaScript or xlink:href attributes to redirect to the AiTM proxy chain. Several PhaaS providers now offer ready-to-use SVG and HTML attachment templates as part of their subscription packages. Traffic Distribution Systems (TDS) — such as BlackTDS (Tycoon 2FA) and Adspect TDS (Mamba 2FA) — filter bot traffic and researchers before victims reach the phishing page.

## GREYVIBE: AI-Enhanced State-Aligned Phishing Operations

GREYVIBE, a Russia-linked threat cluster active since August 2025, represents the most documented case of systematic AI integration across the phishing lifecycle. Active in 2026, the group operates five parallel attack chains (PhantomMail, PhantomClick, PrincessClub, DroneLink, Nebo) targeting Ukrainian military personnel, government agencies, and civilian infrastructure. They use ChatGPT, Google Gemini, and Ideogram AI to generate spear-phishing lures, construct fake websites (adult club sites, drone charity portals, counterfeit Russian military login portals), develop custom AI-generated obfuscators (LOOKVALJS, DAYLIGHT, TEASOUP, LOOKVALPS), and deploy PowerShell RATs (PhantomRelay, LegionRelay) and Android spyware (FallSpy). Their AI-generated code exhibits non-idiomatic variable naming and redundant logic structures — a fingerprint that can aid detection. The group's OPSEC weaknesses include testing samples in public sandboxes, misconfigured access controls exposing backend operations, and co-located crypto-mining.

## AiTM MFA Bypass Mechanisms

Modern AiTM kits operate as synchronous reverse proxies that sit between the victim and the legitimate authentication service. When a victim enters credentials and completes MFA, the proxy relays the request in real time to the legitimate service while intercepting the resulting session cookies and authentication tokens. This allows attackers to establish authenticated sessions without needing to reverse-engineer or bypass MFA protocols. The Starkiller platform (documented March 2026 by CSA) industrializes this approach by running headless Chrome browsers inside Docker containers as proxy instances, defeating SMS OTPs, TOTP authenticator apps, and push notifications. CISA, NSA, and NIST classify FIDO2/passkeys as the only phishing-resistant MFA because cryptographic responses are bound to the legitimate origin domain, making them immune to proxy-based AiTM attacks.

## Implications for Defenders

The convergence of AI-generated content and commoditized PhaaS infrastructure means defenders face an adversary that can regenerate lures and infrastructure in hours, not weeks. Traditional signature-based detection fails against polymorphic AiTM kits with weekly code updates and AI-generated obfuscators. Detection strategies must shift to behavior-based analytics (authentication log inconsistencies, anomalous User-Agent/Application ID pairings), infrastructure tracking (Censys scanning for kit signatures, urlscan.io monitoring), and adoption of phishing-resistant authentication (FIDO2/WebAuthn). The GREYVIBE campaign demonstrates that AI-assisted attribution challenges are real — LLM-generated code with no historical backlinks erodes traditional TTP-based attribution methodologies.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1505 Server Software Component
- T1557 Adversary-in-the-Middle
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts

## Sources

- [Infoblox — The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions](https://www.infoblox.com/blog/threat-intelligence/the-procurement-trap-inside-an-aitm-campaign-targeting-global-institutions/)
- [JUMPSEC — UK Industrial Sector AiTM Phishing Campaign](https://www.jumpsec.com/guides/uk-industrial-sector-aitm-phishing-campaign/)
- [Sekoia — Global Analysis of Adversary-in-the-Middle Phishing Threats (Jan–Apr 2025)](https://www.sekoia.com/blog/global-analysis-of-adversary-in-the-middle-phishing-threats)
- [Cloud Security Alliance — Starkiller PhaaS Platform Research Note](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/CSA_research_note_starkiller-mfa-bypass-phishing-as-a-service_20260321-csa-styled.pdf)
- [Hunter Strategy — GREYVIBE: Russia-Linked AI-Enhanced Multi-Vector Attacks Against Ukraine](https://blog.hunterstrategy.net/new-russia-linked-threat-actor-uses-ai-to-supercharge-multi-vector-attacks-against-ukraine/)
- [WithSecure Labs — GREYVIBE Threat Actor Analysis](https://www.withsecure.com/content/dam/labs/docs/WithSecure_GREYVIBE.pdf)
- [Cloud Security Alliance — GREYVIBE: Anatomy of an AI-Enhanced Nation-State Campaign](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_research_note_greyvibe_ai_nation_state_20260530-csa-styled.pdf)
- [JUMPSEC Labs — AiTM IOC Repository (GitHub)](https://github.com/JumpsecLabs/AiTM-IoCs-Update)
- [KnowBe4 — What AI Can't Hide When It Writes a Phishing Email](https://blog.knowbe4.com/what-ai-cant-hide-when-it-writes-a-phishing-email)
- [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Decryption Digest — AiTM Phishing and MFA Bypass Defense Guide 2026](https://www.decryptiondigest.com/blog/aitm-phishing-mfa-bypass-defense-guide)
- [Cybersecurity News — How Top SOCs Detect and Stop AI Phishing That Beats Email Gateways](https://cybersecuritynews.com/how-top-socs-detect-and-stop-ai-phishing-that-beats-email-gateways/)
- [CISecurity — Cyber Threat Actors Using AiTM Phishing](https://www.cisecurity.org/insights/blog/ctas-using-adversary-in-the-middle-aitm-phishing-attacks)
- [PlanetJon — CodeStorm AiTM Campaign Targeting Microsoft 365](https://www.planetjon.net/news/cybersecurity/deep-dive-the-codestorm-adversary-in-the-middle-aitm-campaign-targeting-microsoft-365/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1879