Phishing as a service (PhaaS) is crime-as-a-subscription: criminal platforms rent out ready-made phishing infrastructure — hosted credential-harvesting pages, email templates, delivery systems and dashboards showing who clicked — so that people with no technical skill can run convincing attacks for a monthly fee. The professional phishing email you got last week was probably built on one of these platforms. This guide covers how the model works, what it costs attackers (and why that price matters to you), and what actually defends against attacks assembled by subscription in 2026.
TL;DR
- Phishing-as-a-service platforms rent the full attack stack: templates, hosting, delivery, and victim-tracking dashboards.
- Microsoft documented the model at scale with BulletProofLink, and disrupted Tycoon 2FA — an adversary-in-the-middle platform behind an estimated 96,000 victims — in March 2026.
- Modern PhaaS captures session cookies, not just passwords, which is why MFA alone no longer stops credential phishing.
- The scale is why training matters: the attacks are professionally produced, so staff reflexes are the layer that scales back.
- Monthly simulations plus one-click reporting close the loop that filters alone cannot.
What is phishing as a service?
For most of phishing's history, running a campaign required skill: build a convincing fake login page, host it without getting caught, mass-mail the lure, collect the credentials. PhaaS turned each of those steps into a rental. A criminal signs up, picks a brand template, uploads a target list, pays the subscription, and the platform handles delivery, hosting, and even a dashboard showing click rates and captured logins.
The economics explain the volume. When the attack stack is rented, the cost of running a campaign falls to nearly zero and the number of people able to run one explodes. Microsoft's analysis of BulletProofLink, one of the largest operations, documented more than 100 phishing templates and a flexible business model where customers could buy pages and ship the emails themselves or use the platform's hosted links (Microsoft Security Blog: Catching the big fish).
How a modern PhaaS attack works
The newest platforms are more sophisticated than the classic fake-login-page model:
- Adversary-in-the-middle design. The phishing page proxies the real login page. The victim enters credentials, the platform relays them to the genuine site in real time, and when the MFA prompt appears it is relayed back — the attacker captures not just the password but the session cookie that MFA approves.
- Session cookie theft. With the cookie, the attacker replays an authenticated session without needing the password or the second factor at all. This is why MFA alone is not enough against these campaigns.
- Anti-analysis tricks. CAPTCHA gates, QR-code lures and conditional page behaviour hide the phishing page from security scanners while showing it to humans.
- Rented delivery. Bulk email sending, phone-number and SMS infrastructure, and lookalike domains are separate services the attacker bundles.
Tycoon 2FA, active since 2023, became one of the largest such platforms: partner analysis credited it with roughly 62% of phishing attempts blocked by Microsoft at its peak, an estimated 96,000 victims worldwide, and more than 55,000 affected Microsoft customers. A coalition led by Microsoft's Digital Crimes Unit with Europol disrupted its infrastructure in March 2026 (Microsoft On the Issues) — though the pattern, as with every PhaaS disruption, is that copycats follow the gap.
Why the subscription model matters for defenders
| Change PhaaS introduced | What it means for your business |
|---|---|
| Unlimited attackers with no skill barrier | Volume goes up; the occasional well-crafted lure is now constant |
| Professional templates for local brands and banks | Generic red-flags training ages fast; local context matters |
| Session-cookie capture defeats password-only checks | MFA must be paired with phishing-resistant methods or detection |
| A/B tested lures and dashboards | Attackers iterate like marketers; static annual training loses |
Every row points to the same conclusion: the industrialisation of phishing is exactly why human-layer defences are measured continuously instead of trained once.
What actually defends against PhaaS attacks
- Phishing-resistant MFA — passkeys or hardware keys — wherever the platform supports it, because they cannot be relayed the way SMS codes and push approvals can.
- Filtering plus reported-mail takedowns. Filters catch bulk campaigns; staff reports get a specific lure pulled for everyone else within minutes.
- Monthly simulations with instant coaching. The platform side iterates weekly, so the training side must run monthly: Cyber Aware's phishing simulations rehearse current lures and auto-enrol clickers in a same-day follow-up lesson, and human risk reporting shows whether click and report rates are actually moving.
- Vendor and payment verification habits. The most expensive PhaaS attacks end in invoice fraud; a phone call to a known number defeats it.
FAQ
What is phishing as a service in simple terms? A criminal subscription that rents out ready-made phishing attacks — pages, emails, hosting and dashboards — so anyone can run convincing campaigns without technical skill.
How much does phishing-as-a-service cost attackers? Subscriptions have historically ranged from tens to hundreds of dollars per month depending on features; the exact figure varies by platform and is not published reliably.
Can MFA stop phishing-as-a-service attacks? Not always. Modern platforms capture session cookies through adversary-in-the-middle pages, bypassing MFA entirely; phishing-resistant methods like passkeys are the counter.
What was the Tycoon 2FA disruption? In March 2026, Microsoft's Digital Crimes Unit worked with Europol and partners to disrupt the infrastructure of Tycoon 2FA, one of the largest phishing-as-a-service platforms, blamed for an estimated 96,000 victims since 2023.
How do we defend our team? Phishing-resistant MFA, email filtering, one-click reporting, and monthly simulations with coaching — the combination catches both the volume campaigns and the crafted ones.
One last thing
The attacker's dashboard shows click rates per campaign; your platform's dashboard shows click rates per person. Whoever measures faster wins — check that your last simulation's clickers got their follow-up lesson the same day.