New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale

Cybersecurity researchers have documented four new phishing kits—BlackForce, GhostFrame, InboxPrime AI, and Spiderman—that enable credential theft at scale. BlackForce, first detected in August 2025, can bypass MFA and OTP prompts via Man-in-the-Browser techniques and is sold on Telegram for €200–€300; researchers from Zscaler ThreatLabz cite it as having impersonated brands such as Disney, Netflix, DHL and UPS.

GhostFrame uses a simple HTML-iframe design to host phishing content, with victims directed to a malicious login page and its content easily swapped by updating the iframe target; Barracuda notes it has helped drive 1M+ stealth phishing attacks.

InboxPrime AI leverages artificial intelligence to automate mass-mail campaigns, offered on a MaaS subscription for $1,000, and includes an AI-generated phishing email tool, real-time spam diagnostics, sender spoofing and template-based campaign management, according to Abnormal researchers.

Spiderman targets dozens of European banks and services, with a modular framework that can capture credentials, login data, and tokens, and even harvest cryptocurrency seeds or OTPs; it is marketed via a Signal group of about 750 members, with targeting across Germany, Austria, Switzerland and Belgium.