GhostFrame phishing kit fuels widespread attacks against millions

GhostFrame is a new phishing-as-a-service kit that has powered more than a million phishing attacks since it was tracked from September 2025. Threat analysts linked over a million attempts to this kit, which they named GhostFrame for its stealthy use of iframes loaded from constantly changing subdomains, a technique designed to evade domain-based detection.

The kit can rotate subdomains during an active session and employs anti-analysis tricks, such as disabling right‑click and blocking common keyboard shortcuts, to hinder investigators. It also spoofs legitimate services by adjusting page titles and favicons to match the brand being impersonated, and hides the login form inside non‑obvious features like image streaming to bypass static content scanners.

Pairing a password manager with MFA offers the best protection, and Malwarebytes urges users to verify unsolicited messages before clicking links, while suggesting its Browser Guard extension as an additional defence. according to Barracuda