Phishing-As-A-Service: The Business Model Helping Cybercriminals Scale

One phishing kit, eight crypto brands. That was the finding from ImpersonAlly’s research, according to Co-Founder and CEO Shlomi Beer, who says the kit was used against names including Uniswap and Aave, with “templated hosts that differed only by brand name and build number”. It’s the criminal equivalent of reusing one letter and swapping the company name at the top, except this letter steals logins.

That’s phishing-as-a-service at work; Mitchell Spicer, Co-Founder of Revelion AI, explains why it’s spreading: “Phishing-as-a-service is lowering the barrier to entry for cybercrime. People no longer need to build their own infrastructure or have the same level of technical expertise to launch an attack.” With more people able to access these tools, businesses have to work out whether their defences were built for the threats now facing them.

Crime With A Customer Support Line

Ran Geva, CEO of Webz.io, lists what a subscription provides: “a domain, a login page, a server, a dashboard, and support”. Dean Gefen, CEO of nuKudo and Dart, describes the experience like this: “In many cases, the experience resembles purchasing a legitimate software subscription.” That’s a slightly alarming sentence when the product in question is built to steal passwords.

The arrangement also splits the labour. Gefen says it “allows inexperienced criminals to deploy tools developed and maintained by more capable operators”, which is how Trevor Horwitz, Co-founder and CISO of TrustNet, arrives at his starting point: “The first thing to understand about phishing-as-a-service is that cybercrime is becoming a business model.” Geva adds the part that should worry anyone running a security team: “Improvements by vendors will be immediately applicable by a large user base.” When one vendor improves its tools, every customer can benefit without having to develop those capabilities themselves.

The Fake Page That Behaves Whenever Security Is Watching

Beer says the kits now rent out the hardest parts of an attack: “paid search ads that place the fake page above the real one, and cloaking that fingerprints every visitor, so security scanners and ad reviewers see a harmless page while real users get the attack.” A fake page that looks innocent to the inspectors and hostile to the customers is a neat trick and it explains why a quick check of a suspicious link might not reveal the threat.

Taking these campaigns down is no easier, because Beer found that “Each layer is disposable, so taking down one page barely slows the campaign.” His advice follows from that: “For businesses, checking a suspicious URL once is no longer enough.” The attack can involve a chain of ads, redirects and throwaway pages, and businesses need to monitor that wider chain rather than relying on a single check.

When The Second Lock Has A Spare Key

Multi-factor authentication is supposed to provide another layer of protection when passwords are stolen, but some phishing services are designed to get around it. Spicer is careful about this: “Multi-factor authentication remains an important security measure, but it’s not foolproof.” Gefen explains how some kits get around it: “More advanced platforms use adversary-in-the-middle techniques that imitate legitimate login pages and relay information between the victim and the real service.”

The prize in these attacks is the session, the thing that keeps an account logged in after the code has been entered. Geva says some kits “can swipe a victim’s authenticated session as they log in”, and Gefen adds that “Once a session token is stolen, an attacker may be able to access the account without completing the authentication process again.” Geva also points out the catch for anyone who responds by changing the password: “Password resets alone can leave sessions open for account access.” Horwitz says this “changes the risk profile for organisations that believe MFA alone provides sufficient protection.”

Assume The Door Is Already Open

If credentials can be stolen and sessions hijacked, the sensible plan starts from there. Alex Ferrer, Head of Blockchain Forensic Investigations at Crypto Legal UK, says “Organisations should prioritise phishing-resistant authentication, such as passkeys or FIDO2 security keys, alongside endpoint monitoring, email filtering, employee awareness training and rapid session revocation when compromise is suspected.” His reasoning is that “Effective defence requires layered security controls that assume credentials can be compromised and limit what an attacker can do afterwards.”

Spicer thinks the habit of checking security only periodically is part of the problem, since the cost of finding and exploiting weaknesses is falling “while many organisations still take a periodic approach to security.” His fix is “Businesses need to look beyond whether controls are in place and test how well they stand up to real attack methods.” Horwitz agrees that no single tool carries the load: “In my experience, the most effective defence is a combination of people, processes, and technology.”

The Attacker Doesn’t Need To Build The Tools

Phishing-as-a-service makes sophisticated cyberattacks accessible to people who might not have the skills to build them from scratch. It reads like a contradiction until you remember that an attacker no longer needs to develop the skills and infrastructure independently. Those capabilities can be rented, with support included.

As these services become easier to access, defending against phishing means looking beyond suspicious emails. Stronger authentication, monitoring for compromised sessions and having a plan to contain attacks all become more important when the person launching an attack doesn’t need to know how to build one.

Our Experts:

• Mitchell Spicer: Co-Founder of Revelion AI
• Shlomi Beer: Co-Founder and CEO of ImpersonAlly
• Alex Ferrer: Head of Blockchain Forensic Investigations at Crypto Legal UK
• Ran Geva: CEO of Webz.io
• Dean Gefen: CEO of nuKudo and Dart
• Trevor Horwitz: Co-founder and CISO of TrustNet

Mitchell Spicer, Co-Founder, Revelion AI

“Phishing-as-a-service is lowering the barrier to entry for cybercrime. People no longer need to build their own infrastructure or have the same level of technical expertise to launch an attack. They can rent tools and services that do much of the work for them, making phishing cheaper and easier to carry out at scale.

“Multi-factor authentication remains an important security measure, but it is not foolproof. Some phishing services are designed to capture session tokens or trick users into handing over access, allowing attackers to get around protections that businesses rely on.

“The wider problem is that the cost of finding and exploiting weaknesses is falling, while many organisations still take a periodic approach to security. Businesses need to look beyond whether controls are in place and test how well they stand up to real attack methods. That means regularly assessing their defences, identifying exploitable weaknesses and making sure those weaknesses are fixed.”

Shlomi Beer, Co-Founder and CEO of ImpersonAlly

“Phishing-as-a-service has turned phishing from a skill into a subscription. In our research at ImpersonAlly, we found a single phishing kit reused against eight crypto brands, including Uniswap and Aave, with templated hosts that differed only by brand name and build number.”

“These kits now also rent out the hardest parts: paid search ads that place the fake page above the real one, and cloaking that fingerprints every visitor, so security scanners and ad reviewers see a harmless page while real users get the attack. Each layer is disposable, so taking down one page barely slows the campaign.”

“For businesses, checking a suspicious URL once is no longer enough. Monitor where your brand appears in ads and search, test from realistic devices and locations, and capture the whole redirect chain as evidence for takedowns.”

Alex Ferrer, Head of Blockchain Forensic Investigations at Crypto Legal UK

“Phishing-as-a-service (PhaaS) has transformed cybercrime by turning sophisticated attack methods into products that can be purchased or rented by people with limited technical expertise. Instead of building phishing infrastructure themselves, criminals can access ready-made templates, hosting infrastructure and tools designed to capture credentials.”

“Some services also facilitate attacks against multi-factor authentication by exploiting stolen session cookies or tricking victims into approving fraudulent login requests.”

“Organisations should prioritise phishing-resistant authentication, such as passkeys or FIDO2 security keys, alongside endpoint monitoring, email filtering, employee awareness training and rapid session revocation when compromise is suspected.”

“As PhaaS platforms become more accessible, the threat is shifting from isolated technical attacks towards scalable, repeatable criminal operations. Effective defence requires layered security controls that assume credentials can be compromised and limit what an attacker can do afterwards.”

Ran Geva, CEO of Webz.io

“Phishing-as-a-service enables criminals to buy phishing kits. Subscriptions provide a domain, a login page, a server, a dashboard, and support, and are therefore appealing to people with little to no programming experience.”

“Some kits can swipe a victim’s authenticated session as they log in, consequently allowing an attacker to access the account after the victim completes a challenge based MFA. Organisations should incorporate phishing-resistant MFA methods like FIDO2 MFA methods and keep an eye out for suspicious account activity.”

“Password resets alone can leave sessions open for account access.”

“I expect new attack techniques to proliferate with this service model. Improvements by vendors will be immediately applicable by a large user base. IT infrastructures should be secured against advanced persistent threats posed by unskilled threat actors.”

Dean Gefen, CEO of nuKudo and Dart

“Phishing-as-a-service has transformed phishing from a technically demanding operation into a readily available commercial product. Attackers can now rent complete packages that include convincing templates, fraudulent login pages, hosting infrastructure, credential-harvesting tools and technical support. This significantly reduces the time, cost and expertise required to launch an effective campaign.”

“More advanced platforms use adversary-in-the-middle techniques that imitate legitimate login pages and relay information between the victim and the real service. This can allow attackers to capture credentials, authentication codes, and active session tokens in real time. Once a session token is stolen, an attacker may be able to access the account without completing the authentication process again.”

“Businesses need a layered defence that combines technology, processes and people. Organisations should adopt phishing-resistant authentication methods such as passkeys or physical security keys, strengthen email and web filtering, limit user privileges and monitor for unusual login or session activity. They should also establish procedures for quickly revoking compromised credentials and sessions.”

“Cybercrime is increasingly operating like a legitimate service economy. Different providers specialise in infrastructure, stolen data, malware, phishing tools, and access to compromised systems.”

Trevor Horwitz, Co-founder and CISO of TrustNet

“The first thing to understand about phishing-as-a-service is that cybercrime is becoming a business model. Attackers no longer need sophisticated technical skills to launch an attack. They can purchase ready-made phishing kits, infrastructure, and even support services, much like legitimate businesses purchase software.”

“What concerns me is that these services are becoming increasingly sophisticated. Some can intercept authentication sessions, allowing attackers to bypass traditional multi-factor authentication. This changes the risk profile for organisations that believe MFA alone provides sufficient protection.”

“In my experience, the most effective defence is a combination of people, processes, and technology. Businesses need phishing-resistant authentication, continuous security awareness training, and clear procedures for verifying suspicious requests.

“The reality is that we cannot eliminate phishing risk. What we can do is build resilience by improving our ability to identify, contain, and recover from attacks before they cause significant damage.”