Top 10 Phishing Kits Used by Cybercriminals

This report catalogues the top 10 phishing kits and PhaaS platforms (e.g., Tycoon2FA, EvilProxy, Sneaky 2FA, EvilTokens, Evilginx) active during 2023–2026, describing their attack flows, technical capabilities (AiTM/reverse-proxy, device-code abuse, Browser-in-the-Browser, WebSocket exfiltration), observed scale (including campaigns affecting hundreds to hundreds of thousands of organizations and thousands of domains), recent disruption efforts, and recommended defensive mitigations such as adopting phishing-resistant authentication, monitoring session/token reuse, and restricting device-code flows.