Phishing as a Service: Inside the Criminal Software Business

When Marc Andreessen declared ‘software is eating the world’, I don’t think many expected the criminal underworld to be among the beneficiaries. But we’re closing in on 2027 and cybercriminals are operating off of subscriptions, usage credits, and customer support. While phishing-as-a-service isn’t a novel concept, threat actors have had some time to innovate and capabilities have evolved since the likes of BulletProofLink. Here is a handful of this year’s most sophisticated, enterprise-targeting PhaaS platforms that have been uncovered.

What is phishing as a service?

Phishing as a service (PhaaS) gives criminals paid access to software and services for running phishing campaigns. A platform may combine fake login pages, hosting, campaign dashboards and tools for coordinating voice phishing calls. Providers may charge subscriptions, license fees or usage credits, with updates and customer support included in some offerings.

Some platforms collect passwords. Others steal session cookies that let attackers reuse a victim’s authenticated session, or trick victims into granting account access through a legitimate service such as Microsoft.

Three phishing as a service platforms targeting enterprises

Commercial terms reflect the published investigations. EvilTokens’ infrastructure was disrupted in September 2026.

Work Panel

Work Panel gives criminal operators the tools to run a team of callers. Managers can onboard new hires, assign them to phishing sites and monitor their activity. Callers cannot view captured employee credentials through their accounts, limiting their ability to resell what the operation steals.

Work Panel’s user-management screen shows administrator, manager and caller roles, alongside account status and activity. Source: Okta Threat Intelligence.

During an attack, a caller talks an employee through a fake corporate login while a manager chooses the prompts and receives passwords and any intercepted MFA codes. The manager can adjust the phishing page as the conversation progresses.

Preparation is also automated. Okta’s July investigation reports that new phishing sites can be ready within minutes. Work Panel handles domain registration and site setup through operator-supplied accounts. Templates cover Okta, Microsoft 365 and Salesforce, with automatic company-branding extraction for the first two. Employee lookup uses the operator’s RocketReach API key to retrieve work emails, phone numbers and job titles.

Operators can send branded emails through their configured mail servers. They supply the callers and phone-service accounts; calls happen in a separate app.

The platform is designed for sale to independent operators. Okta did not disclose pricing or payment terms.

Athena StealthRoute

Athena StealthRoute sells the tools and infrastructure to prepare, deliver and conceal phishing campaigns. Operators can buy domains, phishing pages and lure emails, manage campaign links, and configure filters to divert security scanners.

Those filters can send scanners to a legitimate website while directing prospective victims to the operator’s chosen destination. Operators can connect their own domains, with TLS certificates provisioned automatically.

Marketplace purchases and AI Studio requests draw on the same credit balance. The recovered console includes an Email Writer, alongside tools for generating attachments, page code and benign decoy content. Researchers could inspect these interfaces and their billing logic, but could not identify the AI providers. And, as with most frustrating software purchasing experiences, pricing was hidden behind authentication.

Athena StealthRoute’s marketplace, reconstructed by Abnormal AI from recovered application code. The listings and prices shown are synthetic examples. Source: Abnormal AI.

Abnormal’s October investigation associated Athena’s infrastructure with approximately 89,700 messages flagged as attacks across roughly 2,280 organizations in the US and EU over six months ending October 9, 2026.

Operators still choose the campaign materials and configure the routing. They also supply separate services to collect credentials or tokens, which Athena does not steal itself.

EvilTokens

EvilTokens helped criminals take over Microsoft 365 accounts and use the stolen correspondence to plan payment fraud.

The attack relied on device-code phishing. Employees were persuaded to enter an attacker-supplied code on Microsoft’s genuine sign-in page and authenticate. Completing that process granted the attacker access to their account. EvilTokens obtained access and refresh tokens, allowing the attacker to use the account and renew access without knowing the employee’s password.

Customers received tools for deploying phishing pages, a dashboard for managing compromised accounts and a built-in webmail interface. Sekoia documented a $1,500 payment for lifetime access to the management panel, alongside a required $500 monthly license for the phishing code and backend service. Email-sending tools cost extra. Sales, support and product updates ran through Telegram.

EvilTokens’ administration panel, with controls for captured tokens, active sessions and mailbox analysis. Source: Sekoia TDR.

Once an account was compromised, the platform’s AI tools could analyze up to 5,000 stolen emails alongside contacts, calendar entries and information about managers and direct reports. The software identified payment conversations, suggested whom to impersonate and drafted fraudulent messages using details from existing correspondence. Reports and drafts went to the operator through Telegram. Customers still configured campaigns and decided which proposed frauds to pursue.

Microsoft and its partners disrupted EvilTokens’ infrastructure - while helping authorities scoop up the suspected operators - in September 2026. By then, Microsoft had linked the service to more than 12,000 compromised inboxes across over 10,000 organizations, including financial services, construction and healthcare businesses.

What to expect from phishing as a service in 2027

Better products. Better margins.

Improvements in commercial AI will give PhaaS vendors more features to build into their software, while falling usage costs will make those features more profitable to sell.

ElevenLabs shows both changes happening together. Its February release of Expressive Mode improved control over vocal delivery and how agents decide when to speak, pause or wait. In May, the company cut text-to-speech prices by up to 55% and voice-agent prices by up to 20%. For criminal developers considering automated calling, better conversational timing makes the feature more useful and lower costs could make it easier to sell.

EvilTokens demonstrated how commercial models could become part of a phishing product, using Groq-hosted models to analyze stolen emails and OpenAI’s GPT-4o mini to translate them. OpenAI reduced GPT-5.6 Luna’s API prices by 80% in July.

While it is unlikely any savings get passed down to the ‘customer’, don’t be surprised to see these potential margin gains result in some reinvestment in R&D.

Mass phishing gets personal

In 2027, PhaaS customers will increasingly buy the research along with the software. AI will help turn public information about an employee into a plausible reason to contact them, then write the message.

The cost is already low and the return on investment potential is compelling. In a USENIX study involving more than 7,700 university employees, researchers used public information to generate personalized phishing emails. Those messages produced a 10% click rate, compared with 3.9% for generic messages. Automated research and generation cost an estimated three cents per personalized email.

Athena StealthRoute’s recovered console already includes an AI Email Writer. The next step is connecting tools like it to automated OSINT research. Phishing will increasingly resemble sales prospecting, with software using public information about each recipient to decide how to approach them and what to say.

Personalized spearphishing at this scale could be social engineering’s version of the ‘vulnpocalypse’.

Preparing your team for phishing at scale

Criminals can already buy tools to manage callers, prepare phishing campaigns and turn stolen correspondence into fraud. As commercial AI improves, expect more of the research, writing and calling to be automated.

Give your people a chance to practice responding to convincing requests. Test whether they verify who’s asking before granting access or approving a payment, even when the message fits their work or the caller sounds credible. Include conversations that move between email and phone.

If you’d like to see what that could look like for your team, book a GhostEye demo.