phaas

The W3LL Takedown Is the Third Major PhaaS Bust in 2026. The FBI Is Running a Campaign.

John Z Black Apr 13, 2026

Ransomware & Cybercrime #phishing #phaas #fbi #law-enforcement #mfa-bypass #cybercrime

FBI Atlanta and Indonesian police dismantled W3LL, a full-service phishing-as-a-service platform that had been running since 2019 and was explicitly designed to bypass MFA. It's the third major PhaaS takedown in 2026, and that pattern matters more than any single bust.

Device Code Phishing Is Up 37.5x and Ten Kits Are Competing for Market Share

John Z Black Apr 5, 2026

Ransomware & Cybercrime #device-code-phishing #oauth #phishing-kits #eviltokens #mfa-bypass #phaas

Device code phishing attacks surged 37.5x in 2026 with at least ten competing kits now selling the technique to low-skill criminals.

Microsoft's Device Code Auth Is Now a Criminal Subscription Service

John Z Black Apr 2, 2026

Ransomware & Cybercrime #phishing #microsoft-365 #device-code #eviltokens #bec #phaas #credential-theft

EvilTokens sells device code phishing as a service on Telegram. Over 340 orgs compromised, and victims never see a fake login page.

Tycoon2FA Is Back. It Never Really Left.

John Z Black Mar 24, 2026

Ransomware & Cybercrime #tycoon2fa #phishing-as-a-service #phaas #mfa-bypass #europol #crowdstrike

Europol disrupted Tycoon2FA on March 4. Recovery started the same day. No arrests. By March 23 it was fully operational again. Here's why infrastructure-only takedowns keep failing.