FlowerStorm Phishing Gang KrakVM Obfuscation Campaign | MSSP Advisory

FlowerStorm phishing-as-a-service operation has adopted KrakVM, an open-source JavaScript virtual machine, to conceal credential theft code in HTML attachments. The attacks target Microsoft 365, Hotmail, and GoDaddy credentials plus MFA codes while supporting adversary-in-the-middle session hijacking. Traditional email security and static analysis tools struggle to detect the virtualized execution environment.

Your email security stack may miss these attacks because the virtualized code executes client-side after passing through perimeter defenses. Every client running Microsoft 365 or other targeted services faces credential compromise, and if your monitoring misses the session hijacking, you lose visibility into lateral movement after initial access.

📬