BlackForce Phishing Kit Steals Credentials and Bypasses MFA in Real Time
Summary
ThreatLabz analyzes BlackForce, a phishing kit that steals credentials and MFA codes through real-time Man-in-the-Browser attacks, evades scanners, and sends stolen data through C2 and Telegram channels.
Key points
- First observed in August 2025, BlackForce has at least five versions and has impersonated more than 11 brands, including Disney, Netflix, DHL, and UPS.
- The kit captures credentials and can use a live operator and fake MFA pages to intercept SMS, card, or app-based authentication codes.
- User-Agent, ISP, hostname, country, and scanner filters help block security tools, crawlers, and other unwanted visitors.
- Versions 4 and 5 use sessionStorage to preserve victim data across the attack flow; version 3 could lose data after a refresh or network error.
- The kit's exfiltration architecture evolved from separate client-side C2 and Telegram channels in version 3 to server-side Telegram configuration in versions 4 and 5.
- ThreatLabz lists the detection name HTML.Phish.BlackForce and provides associated indicators and domains.
Article Details
- Attack Vectors
- BlackForce phishing pages impersonate legitimate brands and capture victims’ credentials.
- Operators use a fake MFA page delivered through the BlackForce control panel to capture authentication codes and submit them to the legitimate target website.
- BlackForce filters visitors using User-Agent, IP, resolved-hostname, ISP, and country checks to block scanners and crawlers.
- Defensive Notes
- The article recommends deploying a zero trust architecture to limit access and minimize the damage from account-takeover attacks.
- BlackForce uses blocklists and User-Agent profiling to evade security scanners and automated crawlers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | centro-de-ayuda-help[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | connectrenew-gateway[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | cuenta-renovacion-es[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | cuenta-renueva[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | faq-help-center[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | fixmy-nflix[.]info | Listed as a BlackForce phishing domain. |
| DOMAIN | myflx-sub[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | netfliix-uae[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | netfx-actualizar[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | obnovintfx[.]help | Listed as a BlackForce phishing domain. |
| DOMAIN | renew-netfix[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | supportnetfiixsavza[.]com | Listed as a BlackForce phishing domain. |
| DOMAIN | telenet-flix[.]com | Listed as a BlackForce phishing domain. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelStolen credentials and other victim data are sent to the BlackForce C2 panel.T1056.003 · Web Portal CaptureBlackForce phishing pages capture credentials and fake MFA pages capture authentication codes.T1111 · Multi-Factor Authentication InterceptionOperators capture victims’ MFA codes through a fake MFA page and submit the codes to the legitimate website.T1566.002 · Spearphishing LinkVictims click phishing links that direct them to attacker-controlled BlackForce pages.