A new phishing-as-a-service (PhaaS) platform, Athena StealthRoute, has been identified as using AI tools to both craft and conceal phishing attacks. Researchers from Abnormal AI first spotted its infrastructure during an August 2026 phishing campaign. They observed about 89,700 attack-related messages with the platform’s distinctive link pattern across around 2,280 organisations in the US and Europe over the six months ending 9 October.
The offering includes an AI Studio with six task-specific workflows for generating customised phishing lures, supporting materials and decoy content. The broader system combines domain and link management, a marketplace for campaign assets, visitor monitoring and cloaking controls designed to divert security scanners from malicious destinations.
Five workflows focus on lure creation, while the sixth provides benign-looking decoy content, including a White Page option to mask activity when cloaking redirects, enabling the attacker to evade detection. Athena StealthRoute still relies on external infrastructure for credential and token harvesting, but much of the preparation and delivery can be managed through a single console.
Defenders are urged to consider the combined effects of cloaking and customisable content, as scanners and detection strategies that focus on single messages or link checks may miss the broader campaign, with signals also appearing in shared backend infrastructure and code patterns. Investigations should account for the specific theft mechanism involved, given that credential harvesting occurs via downstream services.