BlackForce PhaaS Weaponizes React and Stateful Sessions to Bypass MFA & Steal Credentials

BlackForce is a PhaaS kit described as a sophisticated toolset that bypasses MFA and steals credentials, with researchers noting its use of a deceptive, legitimate-looking codebase to mimic real enterprise web development. It first emerged in August 2025 and has been sold openly on Telegram for €200–€300, with operators targeting global brands including Disney, Netflix, and DHL.

The kit relies on production builds of React and React Router to disguise its malicious nature, aided by cache-busting techniques that force browsers to load new scripts. Earlier versions were stateless, but newer iterations (V4 and V5) are stateful and leverage the browser’s sessionStorage to persist credentials across a session, enabling a multi-stage attack that survives page reloads.

A live operator-driven attack chain uses a C2 panel to inject a fake MFA prompt and capture one-time codes in real time, with ThreatLabz warning organisations to adopt zero-trust architectures to limit the blast radius of such compromised accounts, according to Zscaler ThreatLabz.