MalwarePublished 18 May 2026

FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation

Source AlienVault OTX General

Description

FlowerStorm is a widely known Phishing-As-A-Service (PhaaS) attack kit that has been active since at least mid-2024, increasingly in large scale campaigns. FlowerStorm performs targeted, complex collection of a victim’s credentials, including the management of multi-factor authentication (MFA).

Impact

The primary impact is unauthorized credential theft, including credentials protected by MFA, which can lead to account compromise and subsequent unauthorized access to victim systems or services. The use of VM-based obfuscation increases the difficulty of detection and analysis, potentially prolonging the window of exposure for victims.

Defensive guidance

As this is a phishing malware campaign rather than a software vulnerability, no patches or official fixes exist. Organizations should focus on user awareness training to recognize phishing attempts, implement strong email filtering, and employ additional detection mechanisms for obfuscated malware. Monitoring for phishing indicators and promptly responding to suspected phishing emails is recommended.

Summary

FlowerStorm is a phishing malware platform that facilitates large-scale credential harvesting, including bypassing MFA protections. It uses KrakVM, a virtual machine-based obfuscation method, to complicate analysis and detection. The attack vector involves phishing emails with HTML attachments, consistent with T1566 (phishing). This PhaaS kit has been active since mid-2024 and continues to evolve its evasion techniques.

Indicators of compromise

Domains 86

6182120286.my.id
alexperu.courtfilecloud.com
7250102277.cfd
5832068083.cyou
7840190445.cyou
bafybeiclfnumyd3aztwl2xjz5o6cfw4fqepqz6a6uow3dig57pf5najq2u.ipfs.w3s.link
5348785839.cfd
rdaol.dreamsintheframe.de
dfjxt.patienceintherain.de
pkxza.ruminatingbrook.de

Hashes 1

b0ed4da928344ac2972a05ded086e4da

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 May 2026, 19:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

Indicators of compromise

Domains 86

Hashes 1

Community reviews

Related threats