Also known as: PhaaS · phishing kit
Phishing-as-a-service (PhaaS) is a subscription model in which criminal platforms sell ready-made phishing kits, hosting, and credential-capture infrastructure to customers who lack the skill to build them.
PhaaS platforms typically provide templated clones of major banking and webmail login pages, real-time credential capture, and increasingly the interception of one-time passcodes — the feature that renders SMS-based multi-factor authentication ineffective against them.
The commoditisation matters for defenders because it decouples attack sophistication from attacker skill. A technically unremarkable criminal can now run a campaign that defeats SMS MFA, which is a substantial part of why phishing-resistant authentication has become the recommended baseline.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Social Engineering
Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.
Ransomware-as-a-Service
Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.