Phishing-as-a-Service (PhaaS)

Phishing-as-a-service (PhaaS) is a criminal business model in which an operator runs the full infrastructure of a phishing operation — hosted fake login pages, proxy servers, domain rotation, evasion features, and a management dashboard — and rents access to it by subscription. Where a traditional phishing kit is a product the buyer must deploy and maintain, PhaaS is a managed service: the subscriber supplies the target list and collects the stolen credentials, and the operator handles everything else, often with support channels and feature updates that mirror a legitimate SaaS vendor.

How it works

A subscriber pays — typically via Telegram, in cryptocurrency, at prices in the low hundreds of dollars per month — and receives panel access for building campaigns from templates that impersonate Microsoft 365, Google, banks, or shipping brands. Modern platforms bundle adversary-in-the-middle proxying as a core feature: the victim's login is relayed to the real identity provider, so passwords, one-time codes, and the post-MFA session cookie are all captured, making MFA bypass a line item on a price list rather than an advanced skill. Evasion is also productized — CAPTCHA gates and geofencing hide the phishing page from security scanners, showing decoys to anyone who is not the intended victim.

The scale this enables is documented. Tycoon 2FA, the most prolific platform of 2025, had roughly 2,000 subscribers yet accounted for about 62% of the phishing attempts Microsoft blocked in mid-2025; a six-country, Europol-coordinated takedown seized 330 of its domains in March 2026, and campaign volume returned to pre-disruption levels within about two days. The economics follow the same specialization as malware-as-a-service: a single developer's capability, multiplied across thousands of unskilled customers.

How to defend against it

Defend against the capability, not the brand name: platforms fall and their subscribers migrate. Phishing-resistant authentication — FIDO2 keys and passkeys — defeats the proxying that PhaaS customers are paying for, and conditional access plus session revocation limits what a stolen cookie is worth. On the human side, phishing simulations that include credential-entry scenarios identify who would authenticate on a convincing fake; our guide to how PhaaS kits bypass MFA covers the full defense playbook.