Krebs on Security is a cybersecurity blog authored by Brian Krebs, an investigative journalist and cybersecurity expert. With a focus on cybercrime, hacking incidents, and data breaches, Krebs on Security provides  analysis, investigative reporting, and security research on emerging threats and cybersecurity trends. Developers and security professionals can learn about the latest cybersecurity threats, security best practices, and incident response strategies from Krebs' investigative reporting and expert analysis.

Krebs on Security

Starkiller is a new phishing-as-a-service platform operated by a threat group called Jinkusu that bypasses traditional phishing defenses by acting as a real-time man-in-the-middle proxy. Instead of serving static fake login pages, it spins up a Docker container with a headless Chrome browser that loads the legitimate target site and relays all user input — including MFA codes and session tokens — through attacker-controlled infrastructure. This effectively neutralizes MFA protections since victims are authenticating with the real site through a proxy. The platform includes keylogging, session cookie theft, geo-tracking, Telegram alerts for new credentials, and a SaaS-style analytics dashboard, dramatically lowering the barrier to entry for novice cybercriminals.

‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA – Krebs on Security