Post by @briankrebs__dup_6@infosec.exchange

2026-02-23 13:10 UTC

A slick new phishing-as-a-service offering demonstrates just how easily a username+password and a one-time token can be phished. Dubbed "Starkiller," the service uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the victim and the legitimate site -- forwarding the victim's username, password and multi-factor authentication code to the legitimate site and returning its responses. https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/ #phishing #MFA #starkiller

Replies (6)

@milagemayvary@mstdn.social 2026-02-23 13:48

@briankrebs@infosec.exchange That's nasty. I don't like it. I used to ironically say the internet was a mistake, but some days lately my thoughts have shifted. I feel like my browser at a minimum needs a behavior shift: if any @ is in the address bar, maybe the browser gives a warning & gives you a chance to look over the address before continuing. Uhg, tummy ache activated.

Open ##2189904
@SueDiOh@mastodon.social 2026-02-23 13:56

@briankrebs@infosec.exchange I think I just ran into this tactic: I clicked on an MSNow story on youtube and it took me to a third party site that flat-out said "you're giving us your info" so I backed out quickly. The company name was something like 'vesuvis' or similar.

Open ##2189905
@3x10to8mps@mastodon.social 2026-02-23 14:06

@briankrebs@infosec.exchange We need the list of sites identified as already being compromised with this

Open ##2189906
@ljrk@todon.eu 2026-02-23 14:21

@briankrebs@infosec.exchange The term "MFA" is just useless as a metric for the security of a system. Just like 3DES, putting multiple broken auth mechanisms behind each other may work as a stop-gap measure but doesn't address the problem at its core.

Open ##2189911
@gh0sti@mastodon.social 2026-02-23 14:25

@briankrebs@infosec.exchange would hosting our own dns like pihole defend against this?

Open ##2189912
@eloy@hsnl.social 2026-02-23 14:40

@briankrebs@infosec.exchange Huh, fascinating, I'm finding StackOverflow comments from 2014 that HTTP Basic Auth credentials in the URL will throw phising warnings in Safari... There was apparently some back and forth ongoing with the removal of this feature in multiple browsers https://serverfault.com/questions/371907/can-you-pass-user-pass-for-http-basic-authentication-in-url-parameters I'm still a regular user of this feature, I hope it does not get removed.

Open ##2189914