Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication

**Executive summary:** Researchers disclosed the Starkiller phishing suite and related phishing-as-a-service tooling that proxy real login pages via headless Chrome in Docker to capture keystrokes, session tokens, and MFA elements; the report also covers an OAuth device-code phishing campaign compromising Microsoft 365 accounts and a multi-stage campaign targeting U.S. banks using .co.com spoof domains, CAPTCHA delays, and obfuscation to evade detection.