AI-POWERED PHISHING-AS-A-SERVICE

Summary from the TLDR IT newsletter

Security researchers uncovered two AI-built Phishing-as-a-Service kits, TokenLover and YaksaLover, that automate business email compromise against Microsoft 365. Marketed like legitimate SaaS products with operator dashboards, they industrialize documented techniques such as device code phishing and Windows Hello persistence. One kit uses AI to map payment flows from harvested mailboxes, and both can keep access after password resets.