GhostFrame: The Stealthy Phishing Kit That’s Already Launched Over 1 Million Attacks

A phishing-as-a-service platform that weaponizes a browser feature every website uses.

GhostFrame is a phishing-as-a-service (PhaaS) kit that Barracuda first identified in September 2025 and linked to over 1 million attacks by December. It rents access to non-technical criminals and hides its credential theft inside an iframe, which is why the outer phishing page passes most static scanners.

Phishing-as-a-service means the attack tooling is a product. Someone else builds and maintains the kit; the buyer just points it at targets and collects stolen logins. That model is why GhostFrame spread so fast - the barrier to running a convincing Microsoft 365 or Google login trap dropped to a rental fee. Barracuda found two code variants, one obfuscated for stealth and one readable with developer comments, which points to an organized effort selling to attackers at different skill levels. The kit can render pixel-perfect copies of Microsoft 365 and Google sign-in pages as images, so what the victim sees is indistinguishable from the real thing.

• It is the first of its kind. Iframe abuse in phishing is not new, but GhostFrame is the first complete framework built around it, per Barracuda's December 2025 report.
• It is a rented weapon. The PhaaS model means several criminal groups run GhostFrame at once, which makes attribution hard and the reach wide.
• It fakes the pages you trust most. Microsoft 365 and Google Workspace login screens are the primary lures, delivered as images so text-based checks miss them.

A two-stage split that keeps the dangerous half out of every scanner's view.

GhostFrame splits the attack in two. The outer HTML page carries no phishing markers and passes inspection. A hidden iframe then loads the real credential-stealing page from a fresh subdomain, generated per victim and rotated mid-session, so blacklisting the domain rarely works.

Think of it as a clean storefront with the crime happening in a back room the inspector never enters. The outer page uses light obfuscation and looks like an ordinary file. Embedded pointers quietly send the browser to a second page through a hidden iframe, and that second page holds the login forms - concealed inside a blob URI image-streaming feature meant for large files, which static scanners are not built to read. A new random subdomain per target makes blacklists useless, and the subdomains can rotate during a single session. A fallback iframe keeps the attack alive even if JavaScript is blocked. The scoreboard below lays out why this design is so hard to stop.

The kit also fights the analysts trying to study it. It blocks right-clicks, disables the F12 developer-tools key, kills shortcuts like Ctrl+U and Ctrl+S, and even disables the Enter key to stop anyone saving or examining the page. By locking down both mouse and keyboard, GhostFrame leaves almost no normal way to inspect what it is doing. That is a deliberate design choice, not an accident, and it is why the usual "look at the source" advice falls flat here.

The delivery is ordinary on purpose. Victims get emails built to feel routine or urgent: fake contract notices ("Secure Contract & Proposal Notification"), spoofed HR notes ("Annual Review Reminder"), fake invoices, and account-security alerts ("Password Reset Request"). Those are the exact subject lines a busy Houston office clicks without a second thought.

The kit targets the tools and gaps common to small and mid-sized firms.

GhostFrame targets Microsoft 365 and Google Workspace logins, the two platforms nearly every Houston SMB runs on. Small firms without dedicated security staff, strong email filtering, or regular awareness training sit at the highest risk, because the kit is built to slip past exactly those missing layers.

Cybercriminals do not pick targets by zip code. A GhostFrame operator renting the kit blasts it at whatever address list they bought, and a Katy engineering firm lands in the same batch as a Fortune 500. What decides the outcome is your defense depth, not your location. The higher-risk profile Barracuda describes reads like a checklist of small-business reality: no dedicated IT security staff, Microsoft 365 or Google Workspace for email and login, sensitive financial or personal data on hand, thin email filtering, and no steady security awareness training. That is the setup for a lot of law firms, CPA practices, and construction offices across Sugar Land and Cypress. In 35 years doing this, the pattern I trust most is boring but true: the businesses that get hit are almost never the ones with the newest firewall - they are the ones where one person, one tired afternoon, typed a password into a page that looked right.

• Your login page is the prize. Microsoft 365 and Google Workspace credentials open email, files, and often the path to a wire-fraud request in the CEO's name.
• MFA is the backstop that still works. Even if credentials are stolen, multi-factor authentication on every business account blocks most account takeovers cold.
• People are the last layer the kit cannot bypass. A trained employee who checks the real URL and reports the "embedded, half-loaded" page is the detection GhostFrame is designed to defeat.