# What is phishing-as-a-service, and how do PhaaS kits get past email filters?

URL: https://iblockspam.com/blog/phishing-as-a-service-kits
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Phishing & threats
Author: iBlockSpam Team

> How phishing-as-a-service (PhaaS) kits like Tycoon2FA and RaccoonO365 work, the email lures they send, why filters miss them and the settings that blunt them.

## Short answer

Phishing-as-a-service (PhaaS) is a criminal subscription business: operators rent out ready-made phishing kits with templates, hosting, MFA-bypass proxies and dashboards, so buyers with little skill can run large campaigns. Microsoft says RaccoonO365 let "anyone" steal Microsoft 365 credentials. The defense is phishing-resistant MFA, time-of-click link checks and fast purging.

Phishing used to need some skill: build a convincing page, find hosting, write the email, collect the results. Phishing-as-a-service (PhaaS) turned all of that into a subscription. This guide explains how PhaaS platforms work, what their emails look like when they reach your inbox, and the settings in Microsoft 365 and Google Workspace that blunt them.

## What is phishing-as-a-service (PhaaS)?

Phishing-as-a-service is a criminal business model in which an operator rents out a complete phishing toolkit, and the infrastructure to run it, to other criminals for a fee. The buyer gets fake sign-in pages, email templates, hosting and a dashboard that collects stolen passwords and session cookies. The operator handles updates and keeps the pages ahead of security tools.

Microsoft's Digital Crimes Unit described one platform, RaccoonO365, as "the fastest-growing tool used by cybercriminals to steal Microsoft 365 usernames and passwords." It said the service "offers subscription-based phishing kits" that "let anyone—even those with little technical skill—steal Microsoft credentials," and that "a single RaccoonO365 subscription allows a criminal to send thousands of phishing emails a day" ([Microsoft, September 2025](https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/)).

Two terms help here. A **phishing kit** is the bundle of files that builds a fake page. **Adversary-in-the-middle (AiTM)** is a kind of kit that relays your sign-in to the real service so it can capture your MFA session as well as your password. Many PhaaS platforms now sell AiTM by default, which is why they matter so much to businesses that rely on app codes or push approvals.

## What does a PhaaS kit include?

A PhaaS subscription is closer to a software product than to a single fake web page. Microsoft Threat Intelligence's [March 2026 analysis of Tycoon2FA](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/), a platform it tracks as being run by Storm-1747, lists what the panel offered: "pre-built templates, attachment files for common lure formats, domain and hosting configuration," plus redirect logic and victim tracking. Microsoft said access was sold on Telegram and Signal, with prices starting at $120 for 10 days of panel access.

| Component | What it does | What defenders see |
|---|---|---|
| Sign-in templates | Copies of Microsoft 365, Google and other sign-in pages, sometimes with your company branding | A page that looks exactly like your normal sign-in |
| AiTM proxy | Relays your password and MFA to the real service and captures the session cookie | MFA completed, attacker signed in anyway |
| Lure templates | Ready-made emails and attachments: shared files, voicemails, invoices, HR notices | Ordinary-looking business notifications |
| CAPTCHA gate | A "verify you're human" page in front of the fake sign-in | Scanners see a harmless CAPTCHA |
| Anti-analysis | Fingerprinting, blocking of datacenter IP addresses, checks for automated browsers | Security tools get a blank or decoy page |
| Disposable domains | Fresh hostnames that live for a day or two | Links whose domains have no reputation yet |
| Dashboard | Collects stolen credentials and session cookies for the buyer | Nothing, until the stolen session is used |

Microsoft said Tycoon2FA was built so that it "allowed even less skilled threat actors to bypass multifactor authentication (MFA)." Its infrastructure used "short-lived (often 24-72 hours)" hostnames, and the operators were "actively checking for analysis of environments or browser automation."

## Which phishing-as-a-service platforms have been taken down?

Several large PhaaS operations have been disrupted by technology companies working with law enforcement. The details below are as reported by the organizations involved, at the time of writing (November 2026).

| Platform | Main target | What happened | Reported scale |
|---|---|---|---|
| RaccoonO365 (Storm-2246) | Microsoft 365 credentials | Microsoft's Digital Crimes Unit seized 338 websites under a US court order, announced September 16, 2025 | At least 5,000 Microsoft credentials stolen from 94 countries; one tax-themed campaign targeted over 2,300 US organizations |
| Tycoon2FA (Storm-1747) | Microsoft 365 credentials and sessions, via AiTM | In an action coordinated by Europol and announced March 4, 2026, with the technical disruption led by Microsoft, 330 domains including phishing pages and control panels were taken down | Microsoft said campaigns reached "over 500,000 organizations each month worldwide" |
| Lighthouse | SMS phishing (smishing), including fake Google sign-in pages | Google filed a lawsuit on November 12, 2025, to dismantle the operation | Google said it "harmed over 1 million victims across more than 120 countries" and used at least 107 templates with Google branding |

The sources are [Microsoft](https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/), [Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/), [Europol](https://www.europol.europa.eu/media-press/newsroom/news/global-phishing-service-platform-taken-down-in-coordinated-public-private-action) and [Google](https://blog.google/company-news/outreach-and-initiatives/public-policy/legal-action-and-legislation-fight-scammers/). Microsoft's comment on RaccoonO365 sums up why this matters: services like it "indicate that we are entering a troubling new phase of cybercrime," one where cybercrime is "accessible to anyone, regardless of technical skill."

## Why does phishing-as-a-service matter for a small business?

Phishing-as-a-service matters to small businesses because it removes the cost and skill that used to limit who could run a convincing, MFA-bypassing campaign. Three things change when phishing is sold as a service:

- **Volume.** PhaaS campaigns aren't hand-picked. A subscriber can send thousands of messages a day to any list of addresses, so a five-person firm is just as likely to receive them as a large company.
- **Quality.** The templates are maintained by people who do this full time. Spelling mistakes and clumsy layouts are no longer a reliable giveaway; see [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email) for the checks that still work.
- **MFA bypass out of the box.** An AiTM kit captures the session, so app codes, SMS codes and push approvals don't stop the sign-in. Our [AiTM guide](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) explains the mechanics.

The end goal is usually money. Once the attacker has a mailbox, the next steps are often [inbox rules that hide replies](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) and [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention): fake invoices, changed bank details and payroll diversion.

## How do I recognize an email sent with a PhaaS kit?

You recognize a PhaaS email by its delivery tricks rather than by its wording, because the wording is professionally written. Microsoft listed Tycoon2FA's common lures as "PDF or DOC/DOCX attachments with QR codes," "SVG files containing embedded redirect logic," HTML attachments and redirect links. Watch for these signs:

1. **A routine notification you didn't expect:** a shared document, a voicemail, a signed contract, an HR or payroll update, a tax form.
2. **The link or code is inside an attachment.** A PDF with a QR code, an SVG "image" you're asked to open, or an HTML file. See [QR code phishing](https://iblockspam.com/blog/qr-code-phishing-quishing), [SVG attachment phishing](https://iblockspam.com/blog/svg-attachment-phishing) and [HTML attachment phishing](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling).
3. **A CAPTCHA or "verify you are human" page comes first.** Real Microsoft 365 or Google sign-in from a document link doesn't normally start with one.
4. **The sign-in page shows your logo but sits on a strange domain.** Branding can be copied; the domain in the address bar can't. [Fake Microsoft login pages](https://iblockspam.com/blog/fake-microsoft-login-phishing) lists the domains Microsoft really uses.
5. **The link goes through several hops.** A redirect on a well-known site, then a short-lived domain, then the sign-in page. Our guide on [how to check if a link is safe](https://iblockspam.com/blog/how-to-check-if-a-link-is-safe) shows how to read the real destination.
6. **A request to sign in again** when you're already signed in to Microsoft 365 or Google.

Here's an invented example of the kind of message a kit template produces:

> **Example of a PhaaS-style lure (not a real message):**
> From: "Payroll Services" <notify@hr-docs-portal.example>
> Subject: Action required: 2026 compensation adjustment for review
> Attachment: Compensation_Review.pdf (contains a QR code)
>
> Your updated compensation statement is ready. Scan the code with your phone to review and acknowledge it before Friday.

The QR code moves the click to your phone, away from the protections on your work computer. The link behind it opens a CAPTCHA, then a sign-in page showing your company logo on a domain registered the day before.

## Why do PhaaS emails get past spam filters?

PhaaS emails get past filters because the kits are designed against the specific checks filters run. The kit's customers pay for exactly this:

- **No reputation to judge.** Domains that last 24 to 72 hours are gone before blocklists catch up.
- **Scanners are shown a decoy.** CAPTCHA gates, browser fingerprinting and blocking of datacenter IP addresses mean an automated scanner, which usually runs in a datacenter, never sees the fake sign-in.
- **The payload is hidden.** QR codes are images, SVG files hide script inside an image format, and HTML attachments build the page on your own computer.
- **Trusted hosting.** Many kits host redirectors or pages on large, legitimate platforms; see [phishing links on trusted cloud services](https://iblockspam.com/blog/phishing-links-on-trusted-cloud-services).
- **Compromised senders.** Mail from a real, hijacked supplier mailbox passes SPF, DKIM and DMARC because it really comes from that supplier.

No single filter catches all of this. That's why Microsoft's advice combines checks before delivery, at the time of click and after delivery, plus MFA that can't be phished. An extra filtering layer in front of your mailboxes adds another set of checks before delivery; our page on [Microsoft 365 protection](https://iblockspam.com/platforms/microsoft-365) explains how that works with Microsoft's own filtering.

## What should admins do about phishing-as-a-service?

Admins should assume some PhaaS emails will be delivered and set controls that limit the damage at each stage. Microsoft's Tycoon2FA report recommends many of the steps below. Menu names are as they appear at the time of writing (November 2026).

### In Microsoft 365

1. **Require phishing-resistant MFA.** In the Microsoft Entra admin center, create a Conditional Access policy that requires the **Phishing-resistant MFA** authentication strength, starting with admins and finance. CISA calls phishing-resistant MFA "the gold standard" ([CISA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)). See [passkeys for email](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email).
2. **Recheck links on click.** Microsoft's advice is to "configure Microsoft Defender for Office 365 to recheck links on click." Safe Links does this when URL rewriting is on, and Microsoft recommends leaving **Let users click through to the original URL** off ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)). Settings are in our [Safe Links and Safe Attachments guide](https://iblockspam.com/blog/microsoft-365-safe-links-safe-attachments).
3. **Keep zero-hour auto purge on.** ZAP moves or quarantines delivered messages that are later found to be phishing. Microsoft says "by default, ZAP for phishing is enabled in anti-spam policies," and that ZAP's search covers the last 48 hours of delivered email ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge)). Check that nobody has turned it off, and that the **Phishing** verdict quarantines rather than moving to Junk. See [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap).
4. **Purge what got through.** When one user reports a kit email, assume everyone got it; see [remove a phishing email from all mailboxes](https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365).
5. **Watch sign-ins.** Investigate sign-ins from unfamiliar locations or new MFA methods registered right after a user reports phishing.

### In Google Workspace

1. **Enforce 2-Step Verification with security keys or passkeys** for high-risk users; see [Google Workspace 2-Step Verification enforcement](https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement).
2. **Turn on Gmail's advanced phishing and malware protections**, including link and attachment checks, under **Apps** > **Google Workspace** > **Gmail** > **Safety**. See [advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection).
3. **Investigate and remove** delivered copies with the [security investigation tool](https://iblockspam.com/blog/google-workspace-security-investigation-tool) where your edition includes it.

### For everyone

Make reporting easy and fast. A PhaaS domain may only live for a day, so the first user report is often the best signal you get. Our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) covers the report buttons in Outlook and Gmail.

## What should I do if I entered my password on a PhaaS page?

Assume the attacker has your session, not just your password, because most PhaaS kits now capture the session cookie.

1. **Tell your IT team straight away** and ask them to revoke all your sessions. A password reset alone doesn't end a stolen session.
2. **Change your password** from a trusted device by typing the service's address yourself.
3. **Check for new MFA methods, inbox rules and forwarding** that you didn't create.
4. **Warn colleagues and contacts** if your account sent anything after the incident, by phone for anything involving payments.

The full checklist is in [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link), and admins can follow [Microsoft 365 compromised account remediation](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation).

## Next steps

- Move admins, finance and executives to passkeys or FIDO2 security keys first. It's the control PhaaS kits can't relay.
- Confirm Safe Links (or Gmail's link protections) and zero-hour auto purge are on, and test your report-and-purge process.
- Tell staff that a CAPTCHA or QR code on the way to a sign-in page is a red flag.
- Cut the volume of lures that reach inboxes. iBlockSpam filters phishing and spoofing at the MX before mail reaches Microsoft 365 or Google Workspace; see [how it works](https://iblockspam.com/how-it-works). The free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows where a suspicious message really came from.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Is phishing-as-a-service the same as a phishing kit?

Not quite. A phishing kit is the set of files that builds a fake sign-in page. Phishing-as-a-service wraps a kit in a rented service: the operator hosts the pages, rotates domains, updates templates, provides a dashboard of stolen credentials and offers support. The buyer pays a subscription and doesn't need to run any infrastructure themselves.

### Why do PhaaS phishing pages show my company's logo?

Kits can show your organization's branding, so the fake page carries your logo and background. Microsoft notes Tycoon2FA pages might include company branding. A familiar logo proves nothing about who runs the page; only the domain in your browser's address bar does.

### Do PhaaS takedowns stop the phishing emails?

They help, but they don't end the threat. A takedown removes domains and panels, such as the 338 websites Microsoft seized from RaccoonO365 in September 2025. Customers of a disrupted service can move to another one, and the same techniques remain in use, so keep the defenses in place after any headline takedown.

### Why do PhaaS emails often start with a CAPTCHA page?

The CAPTCHA is there to keep security scanners out. Automated link checkers can't solve it, so they see a harmless verification page while real people click through to the fake sign-in. Microsoft describes Tycoon2FA using constantly changing custom CAPTCHA pages for this reason. A CAPTCHA before a sign-in page reached from an email is a warning sign.

### Can a small business be targeted by phishing-as-a-service?

Yes. PhaaS campaigns are sent at scale, not hand-picked. Microsoft reported that Tycoon2FA campaigns reached over 500,000 organizations each month and that a RaccoonO365 tax-themed campaign targeted over 2,300 US organizations. Any Microsoft 365 or Google Workspace mailbox is a target because the kits are built for those sign-in pages.

## Sources

- [Microsoft Threat Intelligence: Inside Tycoon2FA, how a leading AiTM phishing kit operated at scale (March 2026)](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/)
- [Microsoft On the Issues: Microsoft seizes 338 websites to disrupt rapidly growing RaccoonO365 phishing service (September 2025)](https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/)
- [Europol: Global phishing-as-a-service platform taken down in coordinated public-private action (March 2026)](https://www.europol.europa.eu/media-press/newsroom/news/global-phishing-service-platform-taken-down-in-coordinated-public-private-action)
- [Google: A dual strategy, legal action and new legislation to fight scammers (November 2025)](https://blog.google/company-news/outreach-and-initiatives/public-policy/legal-action-and-legislation-fight-scammers/)
- [Microsoft Learn: Zero-hour auto purge in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge)
- [Microsoft Learn: Complete Safe Links overview for Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [CISA: Implementing Phishing-Resistant MFA (October 2022)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Microsoft 365 Spam Header Decoder](https://iblockspam.com/tools/microsoft-365-header-analyzer): Paste Microsoft 365 headers to decode SFV, CAT, SCL, BCL and compauth reason codes in plain English — runs in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.

---

Source: iBlockSpam, https://iblockspam.com/blog/phishing-as-a-service-kits (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt