Phishing-as-a-service (PhaaS) is a model where cyber threat actors provide access to phishing kits to others in exchange for a one-time fee or subscription. The FBI's IC3 describes it this way. It lets customers run phishing campaigns without building the tools themselves.
- Also Called3other namesPhaaS · phishing as a service · phishing kit service
- Related Terms3linked entriesPhishing · Adversary-in-the-middle (AiTM) · Malware-as-a-service (MaaS)
What is phishing-as-a-service?
Phishing-as-a-service (PhaaS) is a model where criminals sell or rent ready-made phishing tools to other criminals. The FBI’s Internet Crime Complaint Center (IC3) describes it as a model used by cyber threat actors to provide access to phishing kits in exchange for a one-time fee or subscription. A phishing kit is a ready-made set of tools for running a phishing campaign. Phishing is the use of fake messages and websites to trick people into giving away information.
How does phishing-as-a-service work?
The FBI describes the customer as paying a one-time fee or subscription for access to the kits. An FBI report on one large provider lists what such a service can offer: infrastructure set-up and support, customized phishing pages, smishing services and stolen credential management. Smishing means phishing by text message.
The same FBI report says the provider also offered bespoke customization for additional fees.
Why does it matter?
ENISA, the EU Agency for Cybersecurity, says PhaaS allows the distribution of ready-made phishing kits and indicates automation that paves the way for attackers regardless of their experience. ENISA also says phishing, including vishing, malspam and malvertising, is the leading vector, accounting for about 60% of observed cases in its 2025 threat report.
The FBI report says that service impersonated more than 200 trusted organizations, and describes approximately 42,000 unique domains.
Can it get around multi-factor authentication?
The FBI lists an adversary-in-the-middle proxy for two-factor authentication (2FA) codes among the services one provider offered. In that setup, the attacker sits between the victim and the real site. In a separate FBI announcement about a newer service, attackers send phishing emails that direct victims to a legitimate verification page where they enter a device code. The FBI says this gives the attackers OAuth tokens and persistent access without passwords or additional multi-factor authentication challenges. An OAuth token is a digital pass that lets an app act on an account.
How can organizations respond?
The FBI flash on one provider includes mitigation suggestions that center on lists of phishing domains, blocking domains and setting alerts.
For the device code case, the FBI recommends conditional access policies that block device code flow for all users except those with legitimate business needs, and auditing existing device code use. People who suspect they were compromised can report to IC3 at www.ic3.gov.
Is PhaaS the same as phishing?
No. Phishing is the attack. PhaaS is a way criminals buy the tools to carry it out. Related terms are phishing, malware-as-a-service and adversary-in-the-middle.
Is PhaaS the same as malware-as-a-service?
They follow a similar idea of selling attack tools, but PhaaS is about phishing kits, not malware.
Do you need technical skill to run a phishing campaign this way?
ENISA says PhaaS paves the way for attackers regardless of their experience.
Also Called.
- NamePhaaS
- Namephishing as a service
- Namephishing kit service
Questions.
-
What is phishing-as-a-service (PhaaS)?
PhaaS is a model where criminals sell or rent ready-made phishing tools to other criminals. The FBI's IC3 describes it as providing access to phishing kits in exchange for a one-time fee or subscription.
-
Do you need technical skill to run a PhaaS campaign?
No. ENISA says PhaaS allows the distribution of ready-made phishing kits and paves the way for attackers regardless of their experience, because the tools are rented rather than built.
-
Can PhaaS get around multi-factor authentication?
Some services can. The FBI lists an adversary-in-the-middle proxy for 2FA codes among one provider's services, and describes a newer service that uses device code phishing to gain OAuth tokens without passwords or extra MFA challenges.
-
How can organizations respond to PhaaS?
The FBI suggests lists of phishing domains, blocking domains and setting alerts. For device code phishing it recommends conditional access policies that block device code flow except for users with a business need, and auditing existing use.
Sources
In Our Research
- 1 Phishing-as-a-Service 2.0: The Kits That Bypass MFA Without a Fake Login Page August 2026
- 2 Frappo: A New “Phishing-as-a-Service” On The Dark Web May 2022
- 3 ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026
- 4 The Phishing Came From Your Real Domain: What a Marketing Platform Breach Does to Brand Trust September 2026
- 5 Passwordless Is Not Takeover Proof: Where Passkey Attacks Actually Land September 2026
- 6 No Vulnerability Was Exploited: Inside the SaaS Extortion Wave That Breaks In Through Consent, Not Code September 2026