BrianKrebsFeb 23

A slick new phishing-as-a-service offering demonstrates just how easily a username+password and a one-time token can be phished. Dubbed "Starkiller," the service uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the victim and the legitimate site -- forwarding the victim's username, password and multi-factor authentication code to the legitimate site and returning its responses.

https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/

#phishing #MFA #starkiller

Show threadlj·rk
@briankrebs The term "MFA" is just useless as a metric for the security of a system. Just like 3DES, putting multiple broken auth mechanisms behind each other may work as a stop-gap measure but doesn't address the problem at its core.
Feb 23 at 2:21pmWeb