The Starkiller phishing kit operates as a phishing-as-a-service platform that uses headless browsers and reverse proxies to load legitimate login pages while intercepting credentials, MFA tokens, and session cookies in real time, making traditional MFA completely ineffective.
Brian Krebs adds that Starkiller is one of several services from a group calling itself Jinkusu, and that its links hide the real destination behind the “@” trick, as in login.microsoft.com@<attacker host>.
As ByteArchitect’s analysis points out, detection now requires shifting from identifying fake pages to analyzing session behavior anomalies like impossible travel patterns and device mismatches, while FIDO2 authentication and session binding offer the most effective countermeasures.
Your MFA prompt isn’t protecting you: it’s just adding one more thing for the proxy to forward.
