AISEC > Security News > Phishing > Starkiller Phishing Service Bypasses MFA Security
February 20, 2026 #phishing Source: Krebs on Security 3 min read · 799 words

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

'Starkiller' — сервіс фішингу, який проксує справжні сторінки входу та коди MFA

Starkiller Phishing Service Proxies Real Login Pages—And Your MFA Codes

Security researchers just uncovered something that'll make you reconsider how much you trust MFA alone. There's an active phishing-as-a-service platform called Starkiller that's intercepting credentials and multi-factor authentication codes in real time. Not by cracking anything. Not by exploiting zero-days. By sitting in the middle of your login and forwarding everything to the real login page while silently copying your credentials.

Yes, it's that straightforward. And that effective.

Breaking It Down

According to Krebs on Security, Starkiller uses a proxy relay technique—essentially acting as a Man-in-the-Middle between you and legitimate login infrastructure. You think you're typing your password into Microsoft or Google or whatever service you're accessing. You're not. You're typing it into Starkiller's proxy, which then forwards your credentials to the real login page, grabs your MFA code when you enter it, and sends that along too.

Here's what makes this particularly nasty: The attacker gets your credentials AND your MFA code. Both. At the same time.

Traditional phishing detection relies on spotting fake login pages. But Starkiller isn't hosting fake pages—it's relaying to the genuine ones. Your browser sees a legitimate SSL certificate. The page behaves exactly like the real thing. Your security tools see legitimate traffic flowing to legitimate servers. The whole attack is hidden inside what looks like normal, authenticated activity.

The question that keeps me up at night? How many organizations are still assuming their users won't fall for a phishing email if they've got MFA enabled?

The Technical Side

Here's how the attack chain works in practice. An attacker sends you a phishing email with a link to their proxy server, dressed up to look like a routine password reset or security alert. You click it. You're presented with what appears to be a legitimate login page—because the CSS, the layout, the entire user experience is being relayed in real time from the actual service.

You enter your username and password. The proxy captures it and forwards it immediately to the real login page.

The real service challenges you for MFA. Your authenticator app buzzes. You type in your six-digit code. That gets captured too, then forwarded to the legitimate server. The proxy completes the authentication successfully.

From the user's perspective? They just logged in normally. They might even get redirected to a real dashboard or inbox.

From the attacker's perspective? They've got valid credentials and a valid MFA code that can be replayed within the MFA window—sometimes 30 to 60 seconds. That's more than enough time to establish a session or change account recovery options.

This is why people keep asking: can MFA be hacked? Technically, it depends on your implementation. But a proxy relay like Starkiller doesn't hack MFA at all—it just intercepts it before it becomes authentication. The most secure multi-factor authentication in the world won't protect you if an attacker is sitting between you and the login page collecting your codes in real time.

Who's Affected

Krebs on Security reported that Starkiller has real victims. This isn't theoretical. Organizations across multiple sectors have already been compromised through this service, which apparently operates as a commercial offering for other attackers.

So basically: anyone using email-based phishing vectors. Anyone relying solely on password plus MFA. Anyone whose employees click links in emails they shouldn't.

The scope is genuinely concerning because Starkiller targets any service with an online login page. Microsoft accounts. Google accounts. AWS. GitHub. Financial institutions. Email providers. It's not selective—it works against anything with a web-based authentication interface.

What To Do Now

First, understand that MFA still matters. But it's one layer, not a wall. How does MFA enhance security? It makes credential stuffing and password spray attacks significantly harder. But it doesn't protect you against someone who has both your password AND a valid MFA code collected at the same time.

Start requiring passkeys or hardware security keys instead of time-based codes. These can't be intercepted and replayed the same way because they're cryptographically bound to the actual domain you're logging into. A passkey won't work against Starkiller's proxy because the proxy can't impersonate the cryptographic properties of your hardware key.

Second, enforce email authentication and suspicious login alerts aggressively. When someone logs in from a new location or device, make them verify through a secondary channel—a phone call, a verification code sent to a trusted device, something that breaks the proxy chain.

Third, this is an MFA security breach in the sense that MFA's protection is being bypassed. Monitor your accounts for unusual activity. If you see a login from somewhere you don't recognize, change your password and recovery options immediately.

And keep your employees trained. Not generic training. Real scenarios. Real phishing emails. Real consequences for clicking.

The hard truth: Starkiller exists because it works. Until we move away from static credentials toward true cryptographic authentication, attackers will keep building proxy services. The sooner your organization makes that shift, the better.

Read original article →

// FAQ

Can MFA be hacked if attackers are using proxy relay techniques like Starkiller?

MFA codes can be intercepted before authentication completes via proxy relay, but they aren't technically hacked—they're captured in real time. Hardware keys and passkeys are resistant because they're cryptographically bound to the legitimate domain and won't work with proxy impersonators.

What is the most secure multi-factor authentication against phishing attacks?

Hardware security keys and passkeys offer the strongest protection because they're cryptographically tied to the legitimate service domain and can't be replayed through proxy attacks. Time-based codes are vulnerable to interception, while push notifications can be socially engineered.

How does MFA enhance security if services like Starkiller can intercept codes?

MFA still prevents credential stuffing, password spray attacks, and unauthorized access from stolen passwords alone. However, proxy interception shows it's not sufficient as a sole defense—it must be combined with device-level protections, passwordless authentication, or hardware keys.

// RELATED

#phishing Fake Google Security site uses PWA app to steal credentials, MFA codes 2026-03-02 #phishing SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks 2026-02-25

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →