FlowerStorm

Profile source: Mallory

Observed infrastructure

Last seven days

First activity: Jul 26, 2026
Last activity: Jul 26, 2026
Feed role: Distribution
Host form: 0 IP / 4 hostnames

Leading locations

Leading providers

Cloudflare, Inc.4

Infrastructure traits

Anycast 4
Hosting 4
Proxy 2

MITRE ATT&CK

FlowerStorm in ATT&CK

19 distinct techniques

Techniques

19 techniques

T1566.002 Spearphishing Link T1557 Adversary-in-the-Middle T1078 Valid Accounts T1539 Steal Web Session Cookie T1090 Proxy T1566 Phishing T1056 Input Capture T1078.004 Cloud Accounts T1550.004 Web Session Cookie T1621 Multi-Factor Authentication Request Generation T1056.001 Keylogging T1528 Steal Application Access Token T1567 Exfiltration Over Web Service T1027 Obfuscated Files or Information T1204 User Execution T1071.001 Web Protocols T1059.007 JavaScript T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

Reporting

Research mentioning FlowerStorm

Jul 21

Infoblox Threat Intel

Inside a Global Procurement-Themed AiTM Phishing Campaign

The campaigns described in this blog appear to be the work of a single actor who leverages multiple AiTM phishing kits, including Evilginx, FlowerStorm, and Kali365, to harvest user credentials.

Jul 14

Malware News

Kratos PhaaS Targets US and EU Companies: How to Reduce Microsoft 365 Account Takeover Risk - Malware News - Malware Analysis, News and Indicators

Kratos also shares hosting infrastructure with other AiTM phishing kits, including Tycoon, Flowerstorm, Sneaky2FA, and EvilProxy.

May 14

Sublime

FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation · Blog · Sublime Security

FlowerStorm is a widely known Phishing-As-A-Service (PhaaS) attack kit that has been active since at least mid-2024, increasingly in large scale campaigns.

Feb 24

Sophos Threat Research

Nowhere, man: The 2026 Active Adversary Report | SOPHOS

Victims not only entered their credentials on the Dropbox portal but proceeded to accept an MFA prompt generated shortly after by the attacker. This replay tactic is common among synchronous-replay adversary-in-the-middle phishing kits such as FlowerStorm.