New Starkiller Phishing Framework Uses Real Login Pages to Bypass MFA Security

Starkiller is a phishing-as-a-service framework that runs headless Chrome in Docker to reverse-proxy genuine login pages to victims, capturing credentials and session cookies (including those issued after MFA), and offers features such as live session monitoring, keystroke logging, URL masking, analytics, and modules for financial data theft; defenders are advised to treat this as large-scale session hijacking and prioritize phishing-resistant authentication, token/session monitoring and tighter URL/email controls.