Mandiant dissected Caffeine, a Phishing-as-a-Service platform with an unusually open registration: an email address is all it takes, no referral or underground forum reputation required. For a subscription of around $250 a month, customers get a campaign builder for fake Microsoft 365 login pages, anti-detection features like IP blocklisting and geolocation filtering, and, rarely for a PhaaS kit, lure templates aimed at Russian and Chinese targets. A customer’s misconfigured lure page gave the game away: its error message offered a support link straight into Caffeine, which bounced anyone not logged in to the platform’s login page. Later versions swapped the link for a messenger contact. Compare that with EvilProxy, which Resecurity described a month earlier: $400 a month for reverse-proxy kits that steal session cookies to get past MFA, sold only after an administrator vets the buyer and payment is arranged over Telegram. Crime as a service, now with self-service onboarding.
