‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA
2026-03-04T21:12:50Z•27d591aca2e37677f017623a6733a48e322b156a41d8fd6ca48d6f4b8bf25df0
MFA-bypassbadboxbotnetcredential-theftddosextortioni2piot-botnetkimwolfmicrosoftpatch-tuesdayphishing-as-a-serviceproxy-phishingscattered-lapsusshinyhuntersthreat-actorvulnerability-managementzero-day
What happened
Collection of KrebsOnSecurity stories describing multiple active, high-impact threats: a new phishing-as-a-service called "Starkiller" that proxies legitimate login pages and relays credentials and MFA codes to bypass protections; Kimwolf, an IoT botnet now >2 million devices used for massive DDoS, lateral scanning/infection and to abuse anonymity network I2P (causing service disruptions) and potentially tied to compromises of Badbox 2.0 infrastructure; ongoing harassment/extortion activity by the Scattered Lapsus ShinyHunters group; and Microsoft Patch Tuesday advisories fixing dozens of bugs
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 27d591aca2e37677f017623a6733a48e322b156a41d8fd6ca48d6f4b8bf25df0
- Enrichment time
- 2026-03-04T21:12:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.