What Is Phishing as a Service (PhaaS)?
Phishing as a service (PhaaS), also written phishing-as-a-service, is a cybercrime business model in which an operator builds and maintains phishing infrastructure, then rents access to it, usually by subscription, to affiliates who run campaigns against targets of their choosing. A standalone phishing kit buyer downloads and hosts the tooling alone.
A PhaaS operator retains control of hosting, page templates, evasion code, and the campaign dashboard, and the affiliate pays for continued access without owning the tooling.
How phishing as a service works
The operator does the engineering and the affiliate does the targeting. The operator writes and updates fake login pages, runs hosting and domain rotation, and maintains a control panel. The affiliate logs into that panel, picks a brand template, loads a target list, and launches. Sales, onboarding, and troubleshooting run through Telegram bots and channels with tiered plans that mirror a legitimate software vendor.
Most current platforms use an adversary-in-the-middle (AiTM) reverse proxy. The proxy sits between the victim and the legitimate service and intercepts both the password and the MFA token (opens in new tab). The phishing page forwards the victim's credentials and MFA response to the real login service in real time, so the victim completes a genuine MFA challenge while the proxy captures the session cookie the service issues afterward.
A Tycoon 2FA campaign shows the sequence. An affiliate sends a lure pointing to a page that impersonates Microsoft 365, while a Cloudflare Turnstile check turns away security scanners. The victim enters a password and approves an MFA prompt, and the proxy relays both to Microsoft and stores the authenticated session cookie.
The affiliate replays that cookie to open the mailbox with no password and no second factor, then uses that access for business email compromise (opens in new tab).
Why phishing as a service is hard to stop
PhaaS removes the skill requirement from MFA bypass. Tycoon 2FA's AiTM tooling let even low-skill actors bypass multi-factor authentication (MFA) and run account compromise at scale (opens in new tab). An affiliate needs a Telegram account and a payment method; the operator handles hosting, templates, evasion, and the dashboard.
The operator also engineers infrastructure to outlast blocking. PhaaS operators frequently rotate source code and anti-bot pages and embed SaaS names such as sharepoint and onedrive in subdomains to defeat entropy-based detection.
Bulletproof hosting providers (opens in new tab) rapidly rotate IP addresses through fast-flux DNS, so address-level blocking struggles to keep pace, and a blocked domain costs the operator almost nothing.
Takedowns often redistribute activity across the PhaaS market rather than closing it. Affiliates can migrate to other platforms, operators can rebuild on new domains, and earlier takedowns can create room for replacement services to grow.
Disruption doesn't revoke access already taken: stolen session cookies remain valid after a campaign ends unless defenders revoke them.
Types of phishing as a service platforms
PhaaS platforms sort by delivery channel and the authentication weakness they exploit.
- AiTM reverse-proxy kits. Tycoon 2FA, EvilProxy, Rockstar 2FA, NakedPages, and Greatness relay traffic to the real Microsoft 365 or Google Workspace login and capture the session cookie after MFA. This is an enterprise-facing category, and the number of active AiTM-capable platforms keeps growing.
- Synchronous relay kits. Sneaky 2FA and Mamba 2FA relay traffic through backend servers rather than a transparent proxy. Mamba 2FA uses websocket connections and exfiltrates stolen credentials to attackers through Telegram bots.
- Device code and OAuth kits. The March 2026 EvilTokens kit abuses the Microsoft OAuth device authorization flow (opens in new tab) to obtain tokens without ever collecting a password. Researchers assess its backend as largely AI-generated, and the kit folds in AI-powered automation for the fraud that follows the token theft.
- Smishing platforms. Darcula and Lucid deliver lures over iMessage and RCS to bypass SMS firewalls, and their campaigns impersonate banks and postal and toll services worldwide. Lighthouse runs the same smishing model at scale. Darcula's 2025 release generates a kit for any brand from a single URL and uses generative AI to produce localized lure content.
- Voice and multi-step platforms. Newer offerings automate telephone-oriented attack delivery: an email seeds a call, an AI or human agent runs the script, and a dashboard tracks results.
ATHR, priced around $4,000 plus a cut of stolen funds, lets affiliates run AI voice agents without technical skill.
How to defend against phishing as a service
No single control stops PhaaS; defense has to close the MFA-bypass gap, shrink the spoofable surface, and cover every channel the platforms use.
- Move to phishing-resistant MFA. Cryptography binds FIDO2 and passkey credentials to the legitimate site's origin, so a credential presented to a proxy on a different domain fails. FIDO/WebAuthn credentials (opens in new tab) are the primary widely available phishing-resistant method; SMS codes, TOTP, and push approvals all remain phishable. Where legacy MFA remains, risk-based conditional access, device-compliance checks, and token binding limit what a stolen cookie can do.
- Lock down email authentication. Publish SPF and DKIM and move DMARC to a reject policy (opens in new tab) so receiving servers reject unauthenticated messages that spoof your sending domain.
- Watch continuously for lookalike infrastructure. PhaaS domains and TLS certificates are often short-lived, so external monitoring that catches phishing pages the moment they impersonate your brand determines how many customers reach the page before takedown.
- Extend reporting and training past email. Route abuse@ and employee phishing reports into a triage workflow that extracts indicators and feeds them into blocking, and run simulations over SMS, voice, and collaboration tools as well as email. Affiliates also call help desks directly to talk staff into resetting passwords (opens in new tab) and MFA.
Phishing-resistant MFA closes the AiTM proxy's main opening, but a platform that also strikes over SMS or voice needs monitoring and training that follow it there.
How Doppel helps
Doppel is the Frontier AI Social Engineering Defense (SED) platform unifying Digital Risk Protection (DRP) and Human Risk Management (HRM). Against PhaaS campaigns that move across domains, SMS, social, and email, the Doppel Threat Graph correlates spoofed domains, scam texts, and fake profiles into one view of the attacker infrastructure behind a campaign, and Brand Protection detects and dismantles the lookalike login pages before they reach your customers.
PhaaS operators continually respin domains and refresh certificates, so Doppel's agentic AI correlates the reused templates across that rotation, prioritizes what is live, and executes takedowns across platforms, including registrars and hosts.
Analysts handle the escalations that need human judgment. Simulation then uses the same lure the affiliates sent to turn a detected campaign into an employee test across email, SMS, voice, and messaging apps. Every takedown feeds the graph, which is how each PhaaS iteration sharpens detection and makes your brand too costly to attack.
Request a demo to see how Doppel maps the PhaaS infrastructure targeting your brand and shows it dismantled.
Frequently asked questions about phishing as a service
What is phishing as a service?
Phishing as a service (PhaaS) is a subscription-based cybercrime model in which a developer group builds and hosts phishing infrastructure and rents it to customers, known as affiliates, who run the actual campaigns. The package typically includes fake login pages for specific brands, managed hosting, a dashboard for tracking stolen credentials, evasion features, and support delivered over Telegram. Affiliates pay recurring fees or share a cut of the stolen data with the operator, and the model lets people with no technical skill launch campaigns that once required building and hosting everything themselves.
What is phishing as a service in cybersecurity?
In cybersecurity, phishing as a service refers both to the platforms that supply ready-made phishing campaigns to criminals and to the threat those platforms pose to defenders. What sets PhaaS apart from a one-off kit is durability: the operator keeps updating templates and evasion code, so a blocked campaign resumes on new infrastructure within hours. That durability makes PhaaS an initial access route for business email compromise and account takeover, and a reason phishing-resistant authentication is a priority wherever the risk is highest.
Phishing as a service vs. phishing kit: what is the difference?
A phishing kit is a downloadable bundle of fake pages and credential-logging scripts that the attacker hosts and operates alone; once the developer sells it, the developer has no further involvement. Phishing as a service keeps the infrastructure with the operator, who provides hosting, template updates, evasion code, a management panel, and support for an ongoing fee. The operator retains the underlying code, while affiliates typically work through the dashboard. In the BulletProofLink operation, the operator also kept a copy of every credential the affiliate stole and resold it independently.
What is an example of a phishing-as-a-service attack?
Tycoon 2FA, associated with the Storm-1747 tracking label, is a well-documented recent example: an AiTM reverse-proxy kit that relayed victims' Microsoft 365 credentials and MFA responses to steal the resulting session cookie. Campaigns reached education, healthcare, finance, non-profit, and government organizations. Even after Microsoft and law enforcement disrupted the platform's infrastructure, operators and affiliates migrated and resumed campaigns on new domains, the pattern that makes PhaaS hard to stop through takedowns alone.