The BlackForce phishing kit, first seen in August 2025, is a sophisticated phishing toolkit designed to steal credentials and bypass multi-factor authentication (MFA) using Man-in-the-Browser (MitB) attacks. It impersonates popular brands, leveraging advanced evasion techniques such as blocklists for security vendors and web crawlers to avoid detection. The kit uses a dual-channel communication setup, separating phishing servers from Telegram-based data drops, enabling real-time alerts to attackers. Its attack chain includes user validation, credential capture, and session management via a command-and-control panel. Rapid version updates indicate active development to enhance resilience and evade defenses. The kit targets users through multiple phishing domains, many mimicking streaming services, suggesting a broad attack surface. European organizations face risks from credential theft and MFA bypass, potentially leading to unauthorized access and data breaches. Mitigation requires targeted detection of phishing domains, enhanced user awareness, and monitoring of Telegram-based communications. Countries with high streaming service usage and digital service adoption, such as Spain, Germany, and the UK, are likely most affected.
