‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

Multiple high-impact threats reported across February 2026: a new phishing-as-a-service called “Starkiller” proxies victims to legitimate login pages to capture usernames, passwords and MFA codes in real time (effectively enabling MFA bypass); the Kimwolf IoT botnet has grown to millions of devices, is disrupting the I2P anonymity network, performing local-network scanning and enabling large-scale DDoS and anonymized C2 relay activity (including ties to Badbox 2.0/Aisuru); and Microsoft’s recent Patch Tuesday releases fix dozens of vulnerabilities including multiple actively exploited zero‑day