{
  "name": "FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation",
  "slug": "flowerstorm-unleashes-the-krakvm-phaas-operators-turn-to-vm-based-obfuscation",
  "description": "FlowerStorm is a widely known Phishing-As-A-Service (PhaaS) attack kit that has been active since at least mid-2024, increasingly in large scale campaigns. FlowerStorm performs targeted, complex collection of a victim\u2019s credentials, including the management of multi-factor authentication (MFA).",
  "published": "2026-05-18T16:45:09+00:00",
  "created_at": "2026-05-18T16:45:09+00:00",
  "modified_at": "2026-05-18T16:56:25+00:00",
  "created_at_opencti": "2026-05-18T16:45:09+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-05-18",
    "attachment",
    "flowerstorm",
    "html",
    "kravvm",
    "mfa",
    "phaas",
    "phishing",
    "vm"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "8a032c5c-feb8-4f5e-9b1b-62e128361b5a",
        "name": "FlowerStorm",
        "slug": "flowerstorm"
      }
    ],
    "attack_patterns": [
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "2059746795x.diflucan50.store"
      },
      {
        "id": "",
        "name": "nnqsy.secureenvirotrust.de"
      },
      {
        "id": "",
        "name": "7840190445.cyou"
      },
      {
        "id": "",
        "name": "5348785839.cfd"
      },
      {
        "id": "",
        "name": "evszs.efficiencyworks.de"
      },
      {
        "id": "",
        "name": "sjask.reliablevisibility.de"
      },
      {
        "id": "",
        "name": "6264277690.cfd"
      },
      {
        "id": "",
        "name": "1391604445.cfd"
      },
      {
        "id": "",
        "name": "outrageousorganisation.com.au"
      },
      {
        "id": "",
        "name": "6326889358ghf.cyou"
      },
      {
        "id": "",
        "name": "8103841751.cyou"
      },
      {
        "id": "",
        "name": "chr.v0k3.space"
      },
      {
        "id": "",
        "name": "bill.cloudbusinessfiles.com"
      },
      {
        "id": "",
        "name": "mkreply2024.my.id"
      },
      {
        "id": "",
        "name": "hbfnq.strongsystems.de"
      },
      {
        "id": "",
        "name": "5531648314.cfd"
      },
      {
        "id": "",
        "name": "china.bureauofcourts.com"
      },
      {
        "id": "",
        "name": "1969421924.cyou"
      },
      {
        "id": "",
        "name": "1569742347.cfd"
      },
      {
        "id": "",
        "name": "dr.k5l1m.cfd"
      },
      {
        "id": "",
        "name": "msg.uscourtfiles.com"
      },
      {
        "id": "",
        "name": "unix.wearableartbags.de"
      },
      {
        "id": "",
        "name": "6182120286.my.id"
      },
      {
        "id": "",
        "name": "5624221719.cfd"
      },
      {
        "id": "",
        "name": "muchino.database-server.com"
      },
      {
        "id": "",
        "name": "5334635671.cfd"
      },
      {
        "id": "",
        "name": "alexperu.courtfilecloud.com"
      },
      {
        "id": "",
        "name": "5237741854.cfd"
      },
      {
        "id": "",
        "name": "y.k5l1m.cfd"
      },
      {
        "id": "",
        "name": "amaxelectronics.co.za"
      },
      {
        "id": "",
        "name": "vvbea.builtinlayers.de"
      },
      {
        "id": "",
        "name": "7622350912.cfd"
      },
      {
        "id": "",
        "name": "dfjxt.patienceintherain.de"
      },
      {
        "id": "",
        "name": "6185945827.sbs"
      },
      {
        "id": "",
        "name": "chr.authgsyuuite.com"
      },
      {
        "id": "",
        "name": "pozao.clearconceptsdesign.de"
      },
      {
        "id": "",
        "name": "zpma.uscourtdocuments.com"
      },
      {
        "id": "",
        "name": "qmduj.smoothhost.de"
      },
      {
        "id": "",
        "name": "bombom.courtdocumentshub.com"
      },
      {
        "id": "",
        "name": "8191769809.cfd"
      },
      {
        "id": "",
        "name": "7983520156.cyou"
      },
      {
        "id": "",
        "name": "2067612207.cfd"
      },
      {
        "id": "",
        "name": "2143835084.cfd"
      },
      {
        "id": "",
        "name": "vunbp.scalableplatforms.de"
      },
      {
        "id": "",
        "name": "m.chantstraditionnels.de"
      },
      {
        "id": "",
        "name": "dpqcm.solidreputation.de"
      },
      {
        "id": "",
        "name": "bafybeid6ec6mwvrywozlhpblgzl76qtrcqqx26ryk2cptwtykroufqn4y4.ipfs.w3s.link"
      },
      {
        "id": "",
        "name": "ottm.secureuserguard.de"
      },
      {
        "id": "",
        "name": "1518076290.cyou"
      },
      {
        "id": "",
        "name": "7588085895.cyou"
      },
      {
        "id": "",
        "name": "7250102277.cfd"
      },
      {
        "id": "",
        "name": "uvehh.digitalsuccessframeworks.de"
      },
      {
        "id": "",
        "name": "1419993777.cyou"
      },
      {
        "id": "",
        "name": "zrqdi.dynamicgrowthsystems.de"
      },
      {
        "id": "",
        "name": "tlmsh.germanidentityhub.de"
      },
      {
        "id": "",
        "name": "6970793981ad.cyou"
      },
      {
        "id": "",
        "name": "chris.ggsuitauth.site"
      },
      {
        "id": "",
        "name": "2008377162.cfd"
      },
      {
        "id": "",
        "name": "ableg.docufiled.com"
      },
      {
        "id": "",
        "name": "brenda.5hawb1t.site"
      },
      {
        "id": "",
        "name": "04qq.digitalcompetitiveedge.de"
      },
      {
        "id": "",
        "name": "woovw.maximizevisibility.de"
      },
      {
        "id": "",
        "name": "chris1.k5l1m.cfd"
      },
      {
        "id": "",
        "name": "don.feiracultural.de"
      },
      {
        "id": "",
        "name": "noanme.courtfilecloud.com"
      },
      {
        "id": "",
        "name": "albert.uscourtfilestorage.com"
      },
      {
        "id": "",
        "name": "office.bureaucloudservices.com"
      },
      {
        "id": "",
        "name": "jeny.ggsuitauth.site"
      },
      {
        "id": "",
        "name": "rexjf.digitaltrustbase.de"
      },
      {
        "id": "",
        "name": "bafybeias2uivmggzl2gqjipqgcarbgyvakvk6yljxbcv4a3qroxcujzqaq.ipfs.w3s.link"
      },
      {
        "id": "",
        "name": "asphalt9nitroo.my.id"
      },
      {
        "id": "",
        "name": "5832068083.cyou"
      },
      {
        "id": "",
        "name": "oztff.valueguardians.de"
      },
      {
        "id": "",
        "name": "6837577840.cfd"
      },
      {
        "id": "",
        "name": "towbb.digitalproficiency.de"
      },
      {
        "id": "",
        "name": "cfur.invoclegal.com"
      },
      {
        "id": "",
        "name": "bafybeiclfnumyd3aztwl2xjz5o6cfw4fqepqz6a6uow3dig57pf5najq2u.ipfs.w3s.link"
      },
      {
        "id": "",
        "name": "rdaol.dreamsintheframe.de"
      },
      {
        "id": "",
        "name": "empire.appdocstorage.com"
      },
      {
        "id": "",
        "name": "6438259665.cfd"
      },
      {
        "id": "",
        "name": "6018258857.cfd"
      },
      {
        "id": "",
        "name": "7766360391.cfd"
      },
      {
        "id": "",
        "name": "irigc.precisionontheweb.de"
      },
      {
        "id": "",
        "name": "valid.seashellshoetreasures.de"
      },
      {
        "id": "",
        "name": "pkxza.ruminatingbrook.de"
      },
      {
        "id": "",
        "name": "lifeofa.k5l1m.cfd"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/6a0b5e378b3635e94b3b7656",
    "https://sublime.security/blog/flowerstorm-unleashes-the-krakvm-phaas-operators-turn-to-vm-based-obfuscation/"
  ]
}