Security researchers are tracking four new phishing kits – BlackForce, GhostFrame, InboxPrime AI, and Spiderman – that are purpose-built to steal credentials at scale and support high-volume, automated campaigns.

BlackForce, first seen in August 2025, is engineered to harvest credentials and execute Man-in-the-Browser (MitB) flows to capture one-time passwords (OTPs) and sidestep multi-factor authentication (MFA). The kit is actively sold on Telegram channels for €200 ($234) to €300 ($351), making it easily accessible to lower-skilled actors.

The kit, according to Zscaler ThreatLabz researchers Gladis Brinda R and Ashwathi Sasi, has been observed spoofing more than 11 well-known brands, including Disney, Netflix, DHL, and UPS, and continues to receive frequent updates.

“BlackForce features several evasion techniques with a blocklist that filters out security vendors, web crawlers, and scanners,” the company said. “BlackForce remains under active development. Version 3 was widely used until early August, with versions 4 and 5 being released in subsequent months.”

Landing pages tied to the kit rely on JavaScript files that use so-called “cache busting” hashes in their filenames (for example, “index-[hash].js”), forcing the victim’s browser to pull down the latest malicious script instead of reusing a cached copy. This complicates static signature matching and change tracking.

In a standard BlackForce run, a user clicking a lure link is redirected to a malicious phishing page. A server-side check removes crawlers and automated scanners, then serves a page that closely mirrors a legitimate brand site. Once the victim submits credentials, the data is forwarded in real time to a Telegram bot and a command-and-control (C2) panel via the HTTP client Axios, enabling rapid account takeover attempts.

When the attacker replays the stolen credentials against the real service, the legitimate site triggers MFA. At that point, BlackForce uses MitB techniques via the C2 panel to inject a fake MFA prompt into the victim’s browser session. If the user types the OTP into the spoofed prompt, the code is captured in real time and used to complete the login, giving the attacker full account access.

“Once the attack is complete, the victim is redirected to the homepage of the legitimate website, hiding evidence of the compromise and ensuring the victim remains unaware of the attack,” Zscaler said. For SOC teams, this means fewer user-reported incidents and a heavier reliance on telemetry-based detection.

GhostFrame Fuels 1M+ Stealth Phishing Attacks

GhostFrame, another emerging kit gaining adoption since September 2025, uses a lightweight delivery model. A seemingly benign HTML wrapper page embeds an iframe that silently loads the real phishing content, sending users to fake Microsoft 365 or Google login portals and harvesting their credentials.

“The iframe design also allows attackers to easily switch out the phishing content, try new tricks or target specific regions, all without changing the main web page that distributes the kit,” Barracuda security researcher Sreyas Shetty said. “Further, by simply updating where the iframe points, the kit can avoid being detected by security tools that only check the outer page.”

GhostFrame campaigns typically start with phishing emails themed around contracts, invoices, or password resets, all funneling recipients to the same outer page. The kit incorporates anti-analysis and anti-debugging logic to frustrate inspection via browser developer tools and spins up a new random subdomain on each visit, which complicates domain-based blocking and correlation across incidents.

The visible outer page loads a script that initializes the iframe and processes messages from it. This script can adjust the parent page’s title to impersonate well-known SaaS platforms, swap in a corresponding favicon, or even redirect the top-level browser window to a different domain, making it harder for users and simple content checks to spot anything unusual.

In the final stage, the victim is forwarded through the iframe to a second-level page that hosts the actual phishing logic. The use of continually changing subdomains reduces the effectiveness of static blocklists. A backup iframe appended to the end of the page provides a failover path if the primary loader JavaScript is blocked or fails, preserving campaign uptime.

InboxPrime AI Phishing Kit Automates Email Attacks

While BlackForce focuses on the credential capture layer, InboxPrime AI targets the delivery side by using artificial intelligence (AI) to industrialize bulk phishing mail. The kit is promoted in a Telegram group with around 1,300 members under a malware-as-a-service (MaaS) subscription model priced at $1,000, with a perpetual license and full source access included.

“It is designed to mimic real human emailing behavior and even leverages Gmail’s web interface to evade traditional filtering mechanisms,” Abnormal researchers Callie Baron and Piotr Wojtyla said.

“InboxPrime AI blends artificial intelligence with operational evasion techniques and promises cybercriminals near-perfect deliverability, automated campaign generation, and a polished, professional interface that mirrors legitimate email marketing software.”

The platform exposes a management console that lets customers handle accounts, proxies, templates, and campaigns in a way that closely resembles commercial email automation suites. A central capability is the AI-driven email generator, which can create full phishing messages – including subject lines – that align with normal business communication patterns.

As a result, threat actors can outsource most of the content creation work to the tool. Instead of drafting messages manually, they choose parameters like language, topic or vertical, length, and desired tone. InboxPrime AI then uses those inputs to build tailored lures aligned to the selected scenario, reducing prep time and making campaigns more consistent.

The dashboard also lets operators save generated messages as templates, with optional spintax support to rotate specific variables and produce many slightly different variants. This keeps individual emails from looking identical, making it harder for signature-based content filters to reliably flag the mail stream.

Some of the other supported features in InboxPrime AI are listed below –

• A real-time spam diagnostic module that can analyze a generated email for common spam-filter triggers and suggest precise corrections
• Sender identity randomization and spoofing, enabling attackers to customize display names for each Gmail session

“This industrialization of phishing has direct implications for defenders: more attackers can now launch more campaigns with more volume, without any corresponding increase in defender bandwidth or resources,” Abnormal said. “This not only accelerates campaign launch time but also ensures consistent message quality, enables scalable, thematic targeting across industries, and empowers attackers to run professional-looking phishing operations without copywriting expertise.”

Spiderman Creates Pixel-Perfect Replicas of European Banks

Spiderman, another phishing framework currently under scrutiny, is focused on customers of European banks and online financial platforms, including Blau, CaixaBank, Comdirect, Commerzbank, Deutsche Bank, ING, O2, Volksbank, Klarna, and PayPal.

“Spiderman is a full-stack phishing framework that replicates dozens of European banking login pages, and even some government portals,” Varonis researcher Daniel Kelley said. “Its organized interface provides cybercriminals with an all-in-one platform to launch phishing campaigns, capture credentials, and manage stolen session data in real-time.”

A notable detail for defenders is the kit’s distribution model: the seller markets it in a Signal group with roughly 750 members, instead of the more common Telegram ecosystems. The service concentrates on victims in Germany, Austria, Switzerland, and Belgium, which should guide regional threat modeling and playbook tuning.

Similar to BlackForce, Spiderman uses ISP allowlisting, geofencing, and device-level filters to ensure only targets that match its criteria can reach the phishing content. The kit is also capable of capturing cryptocurrency wallet seed phrases, intercepting OTP and PhotoTAN codes, and driving additional prompts to collect credit card details, enabling multi-step financial fraud.

“This flexible, multi-step approach is particularly effective in European banking fraud, where login credentials alone often aren’t enough to authorize transactions,” Kelley explained. “After capturing credentials, Spiderman logs each session with a unique identifier so the attacker can maintain continuity through the entire phishing workflow.”

Hybrid Salty-Tycoon 2FA Attacks Spotted

BlackForce, GhostFrame, InboxPrime AI, and Spiderman join an already crowded ecosystem of phishing kits such as Tycoon 2FA, Salty 2FA, Sneaky 2FA, Whisper 2FA, Cephas, and Astaroth (not to be confused with a Windows banking trojan that uses the same name) that have surfaced over the past year.

In a report released earlier this month, ANY.RUN described a new Salty–Tycoon hybrid kit that is already slipping past detection logic written specifically for either family. The activity spike for this hybrid coincides with a sharp decline in Salty 2FA usage in late October 2025. Early stages of the chain match Salty2FA behavior, while later stages pull in code that mirrors Tycoon 2FA’s execution flow.

“This overlap marks a meaningful shift; one that weakens kit-specific rules, complicates attribution, and gives threat actors more room to slip past early detection,” the company said.

“Taken together, this provides clear evidence that a single phishing campaign, and, more interestingly, a single sample, contains traces of both Salty 2FA and Tycoon, with Tycoon serving as a fallback payload once the Salty infrastructure stopped working for reasons that are still unclear.”

Found this article useful from a defense standpoint? Follow us on Google News, Twitter and LinkedIn to keep up with additional coverage of phishing tooling and detection-relevant trends.