Security researchers who infiltrated several marketplaces describe a mature software business: tiered pricing, uptime guarantees and onboarding videos. Kits bypass common multi-factor prompts by proxying the real login page in real time.
Implications for defenders
If anyone can rent a professional-grade campaign, user training alone will not hold. Phishing-resistant authentication, domain monitoring and fast takedown relationships are the controls that scale.
Key takeaways
- Kits proxy real login pages to defeat one-time codes
- Subscriptions start at the price of a streaming service
- Takedown speed matters more than awareness training
This story is part of our ongoing coverage of cybersecurity. We will update it as more details emerge.
