New FlowerStorm Microsoft phishing service fills void left by Rockstar2FA

FlowerStorm is a growing phishing-as-a-service platform that rapidly filled the gap left by the partial collapse of Rockstar2FA; it supports AiTM attacks against Microsoft 365, harvests credentials and MFA tokens, and displays strong similarities in infrastructure and phishing kit content to Rockstar2FA. Sophos telemetry shows heavy targeting in the United States across services, manufacturing, retail, and financial sectors; the report highlights domain/hosting patterns, shared TTPs, and defensive recommendations such as FIDO2-resistant MFA, email filtering, and DNS blocking of suspicious TLDs.