‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA
2026-03-04T21:13:43Z•410ab6c9ae23869bdd4de26ccfe1cf3a0bf5cb1baf8eabd66c2a5da7f4948fbb
Android TVBadbox 2.0DDoSI2PIoT botnetKimwolfMFA bypassMicrosoft Patch TuesdayScattered LapsusStarkillerextortionphishingphishing-as-a-servicevulnerability managementzero-day
What happened
Collection of KrebsOnSecurity stories (Jan–Feb 2026) detailing several high-impact threats: a new phishing‑as‑a‑service called “Starkiller” that proxies victims to real login pages and relays usernames, passwords and MFA codes to bypass multi‑factor protections; the Kimwolf IoT botnet (reported >2 million infected devices) conducting massive DDoS, scanning local networks to propagate, infecting Android TV streaming boxes (ties to Badbox 2.0) and abusing the I2P anonymity network to evade takedowns; and multiple Microsoft Patch Tuesday advisories (Jan/Feb 2026) fixing dozens of vulnerabilities,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 410ab6c9ae23869bdd4de26ccfe1cf3a0bf5cb1baf8eabd66c2a5da7f4948fbb
- Enrichment time
- 2026-03-04T21:13:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.