How Phishing Kits Targeting U.S. Giants Are Built, Sold, and Deployed

Modern Phishing-as-a-Service (PhaaS) and AiTM phishing kits now enable attackers to capture authenticated session cookies (effectively bypassing MFA) using reverse-proxy and application-driven architectures; these kits are commercially available via Telegram and underground marketplaces at low cost, abuse trusted cloud infrastructure and QR/email delivery for distribution, and are used by both criminal groups and nation-state actors — creating a high-scale, persistent threat to enterprises.