Phishing-as-a-Service is lowering the bar for attackers
Running a convincing phishing campaign used to take real skill: cloning a login page, hosting infrastructure that wouldn't get burned in a day, and a way to actually catch the credentials as they came in. Phishing-as-a-Service (PhaaS) kits have turned that into a subscription. For a monthly fee, an affiliate gets a ready-made kit, hosting that rotates to dodge takedowns, and a dashboard of harvested logins — no development skill required.
The part that should worry you: MFA bypass by default
The more advanced kits don't just steal a password. They act as a reverse proxy between the victim and the real login page, passing the session through in real time — including the one-time code the victim types in. That session token is captured the moment MFA succeeds, which means a stolen password paired with SMS or app-based one-time codes is no longer enough to stop the login. This is why security teams increasingly treat phishable MFA (codes, push approval) as only a partial control rather than a solved problem.
What holds up against it
- Phishing-resistant MFA — hardware security keys or passkeys using FIDO2/WebAuthn bind the login to the real domain, so a proxied fake page simply can't complete the handshake. This is the single biggest upgrade available today.
- Conditional access and session risk checks — flagging logins from new devices, unusual locations, or impossible travel, even after a valid MFA prompt.
- Shortened session lifetimes on sensitive applications, so a stolen session token is worth less to whoever captured it.
- User training that targets the actual lure — urgency, a familiar brand, a login page one click away — rather than generic "don't click links" advice that doesn't match how these pages look.
If your MFA can be typed into a fake page, it can be relayed straight through to the real one.
Phishing-as-a-Service didn't invent phishing — it industrialized it. The response has to be structural too: assume some phishing emails will land, and make sure a clicked link and a typed code still isn't enough to get in.