Phishing-as-a-Service with AI and real-time OTP capture: what changes for enterprise defense

Google Threat Intelligence’s analysis of Chinese-language PhaaS shows more automated, localized phishing capable of bypassing OTP-based MFA. Organizations need to move from awareness-only programs to phishing-resistant technical controls.

From static phishing to crime as a platform

Google Threat Intelligence Group has published an analysis of the evolution of Chinese-language phishing-as-a-service, or PhaaS. According to GTIG, this ecosystem is not simply copying models already observed in other criminal markets: it offers mature platforms, administration panels, ancillary services, domain registration, hosting, message delivery, personal data sales, and support for monetization.

The operational point for organizations is clear: phishing can no longer be treated as a sequence of poorly written emails that can be handled with filters and periodic training. The campaigns described by GTIG are designed to be industrialized, localized, and adaptable. In some cases, they use channels such as RCS and iMessage, where end-to-end encryption can limit the ability of server-side controls to inspect malicious links. At the same time, live panels allow attackers to interact with victims while they enter credentials and temporary codes.

This changes risk assessment. An organization that protects accounts mainly with passwords plus OTPs may be exposed to scenarios in which the OTP is captured and used within seconds. Training remains useful, but it is no longer sufficient as the primary control. Organizations need architectures where a stolen credential is difficult, or ideally useless, to reuse.

Why OTPs, SMS codes, and weak approvals become a critical point

GTIG observes a shift from simple password harvesting to real-time interception and tokenization. In practice, the user enters credentials and a one-time code into a fraudulent page; the criminal operator sees the data in a panel, starts a request on the legitimate service, and uses the code before it expires. This model leaves very little time to react.

For companies, banks, e-commerce operators, public administrations, and platforms with reserved areas, the consequence is concrete: it is not enough to ask whether MFA is enabled, but which type of MFA is being used and which attacks it can resist. SMS OTPs, app-generated codes, and non-contextual push approvals may be vulnerable to social engineering, relay attacks, or induced consent. FIDO2/WebAuthn solutions and passkeys, when implemented correctly, are more resistant to phishing because they bind authentication to the legitimate domain and the device.

This does not eliminate every risk. As the source notes, a security key cannot prevent a user from entering payment details into a fake site. It does, however, reduce the possibility that credentials and codes can be converted into valid access. For this reason, migration toward phishing-resistant authentication should be accompanied by session controls, conditional access, device verification, alerts on anomalous logins, and rapid token revocation procedures.

AI, localization, and brand abuse: the issue is not only internal access

Another relevant element in GTIG’s analysis concerns AI-based automation. According to the source, some PhaaS platforms use page generators and browser automation tools to clone legitimate websites starting from the target URL. The practical effect is that each page can be different enough to reduce the effectiveness of controls based only on static signatures.

Localization further increases the risk. GTIG cites the case of YY Lai Yu, a platform that reportedly supported campaigns in numerous countries and developed hundreds of templates linked to brands, consumer habits, loyalty programs, subsidies, and local services. For a European organization, this means that brand abuse may happen outside the company’s IT perimeter: lookalike domains, cloned pages, consumer messaging channels, and campaigns targeting customers can create reputational damage, fraud, and pressure on customer support.

Defense must therefore include activities that are often underestimated: typosquatting domain monitoring, clone page detection, takedown procedures, coordinated communications with customers and partners, and integration between security, marketing, legal, and support teams. Organizations that manage transactional platforms, marketplaces, or financial services should also review flows for new device enrollment, password changes, account recovery, and digital wallet provisioning.

In this area, a Cyber & Cloud program can help connect technical hardening, identity management, monitoring, and incident response. Governance consulting is equally important when policies, roles, responsibilities, and clear decision-making processes are required.

Operational checklist to reduce risk

The first action is to map the authentication methods actually in use: employees, administrators, suppliers, customers, and service accounts. Privileged accounts should be the first candidates for FIDO2/WebAuthn or managed passkeys, with a gradual reduction of SMS OTPs where possible.

Second: introduce risk-based access controls. Location, device reputation, impossible travel, sudden browser changes, suspicious proxy use, and wallet provisioning requests should influence the level of verification required. Not every event needs to block the user, but high-risk events should trigger step-up authentication, quarantine, or review.

Third: update logging and incident response. If an OTP is intercepted, the useful response window is extremely short. Playbooks should cover session revocation, credential reset, token invalidation, device blocking, checks on email forwarding rules, verification of subsequent accesses, and communication with affected users. In cloud environments, this work must be integrated with IAM, SIEM, alerting, and automation: areas where a Cloud Managed DevOps service can make controls more continuous and less manual.

Fourth: measure resilience, not only compliance. A useful test is not “have we delivered training?”, but “can a stolen code still open a session?”, “is a cloned domain detected in hours or weeks?”, “does customer care know how to recognize an active campaign?”, “who decides on takedown?”.

The direction indicated by GTIG’s analysis is clear: modern phishing defense must make the attack less monetizable. Recognizing a fake message is not enough; organizations must prevent credentials, OTPs, and submitted data from rapidly becoming access, fraud, or unauthorized tokenization.

Approfondimenti Dedaloop

Fonti