Blacksite is a newly identified AiTM phishing kit sold as a phishing-as-a-service offering paired with Cloaked.gg, a cloaking platform designed to evade automated security analysis. The kit functions as a reverse-proxy that captures authentication tokens, session cookies, and two-factor authentication codes in real time, facilitating full account takeover even when MFA is enabled. Cloaked.gg enhances evasion by blocking scanner traffic from AWS, Google Cloud, and Azure IP ranges and serving AI-generated decoy pages to make malicious URLs appear benign during automated scans. This combination enables attackers to conduct sophisticated credential theft campaigns with reduced detection risk. The service targets consumer, financial, and enterprise identity systems and is priced between $600 and $1,000 monthly. There are no known exploits in the wild beyond the service's own operation, and no software patch or vendor fix applies.

The threat enables attackers to bypass multi-factor authentication protections by intercepting authentication tokens, session cookies, and 2FA codes in real time, leading to full account takeover. The cloaking technology reduces detection by automated URL scanners and security tools, increasing the likelihood of successful phishing attacks. This can result in credential theft affecting consumer, financial, and enterprise accounts, potentially causing financial loss, identity theft, and unauthorized access to sensitive systems.

No official patches or fixes exist as this is a phishing service rather than a software vulnerability. Defenders should focus on user education to recognize phishing attempts, implement strong anomaly detection for account activity, and consider additional security controls such as hardware-based MFA tokens or phishing-resistant authentication methods. Monitoring for the listed malicious domains and blocking or blacklisting them in network defenses can help reduce exposure. Since the service evades automated scanners, reliance solely on URL scanning is insufficient.