Phishing-as-a-Service (PhaaS), explained

Phishing used to require some skill: clone a page, set up hosting, dodge detection. Today, much of that comes pre-packaged and for sale. Phishing-as-a-Service — PhaaS — has turned attacks into a subscription product, and it is a big reason the volume and quality of phishing keep rising. Here is what it is and what actually counters it.

Crime, productised

PhaaS applies the software-as-a-service model to phishing. Instead of building an attack from scratch, a buyer rents a ready-made operation. Typical offerings include:

• Pre-built kits — pixel-perfect clones of popular login pages, ready to deploy.
• Credential-capture backends — infrastructure that collects and forwards stolen logins in real time.
• Cloaking — built in, so pages show crawlers a decoy and victims the trap without the buyer configuring anything.
• Hosting and domains — resilient, sometimes bulletproof, with lookalike-domain guidance.
• Support and updates — tiers, dashboards, even customer service, like any other subscription.

Why it scales the threat

Three effects compound:

1. Lower barrier. No skill required, so the pool of attackers grows.
2. Higher quality. Kits bake in cloaking and convincing clones, so even low-skill attacks evade scanners and fool users.
3. Faster iteration. When one page is removed, a buyer spins up the next from the same kit in minutes.

For a defender, this means you are rarely fighting one clever attacker. You are facing a production line.

The weakness of a production line

Here is the encouraging part: because PhaaS kits reuse the same mechanics, they share the same weaknesses. Nearly every kit relies on two things — cloaking to hide from scanners and lookalike domains to look legitimate. Defeat those consistently and the kit's polish does not save it.

The counter: detect and remove at scale

If attacks launch at scale, the defence has to remove at scale:

1. Detect clones and lookalike domains continuously, since kits produce many.
2. Defeat the cloaking with dual-profile crawling — the one step every kit tries to prevent.
3. Capture evidence automatically, so volume does not slow you down.
4. File takedowns fast and track to removal, then catch the next page from the same operation.

The takeaway

Phishing-as-a-Service has turned attacks into a product, raising both the volume and the sophistication of what brands face. But productised crime inherits productised weaknesses: the same cloaking and lookalike domains on every page. Detect those, defeat the cloak, and remove pages as fast as the kits create them — that is how you counter an attack that comes off an assembly line.