Phishing-as-a-Service: Inside Two AI-Built Kits That Automate BEC

Blog

About Eye

Our product

Incident response

eye.security

About the Product

Partner Portal

Customer Portal

Home AI-powered Phishing-as-a-Service: Inside Two BEC Kits

← Return to overview

AI-powered Phishing-as-a-Service: Inside Two BEC Kits

Jul 28, 2026

By: Jorn Pieterse

-->

-->

Business email compromise (BEC) remains one of the most damaging threats we respond to, and the tooling behind it is getting more complex by the day. On a recent investigation, we came across multiple suspicious domains that piqued our interest. These led us to two phishing kits we had not encountered before.

Both look, at a glance, like legitimate SaaS products. Both were clearly built with AI, down to the comments and code structure. And both automate the full path from a stolen login to a forged invoice.

Neither kit relies on a new technique. Device code abuse, token theft, Windows Hello persistence: all of it is documented, some of it by Microsoft’s own threat intelligence team. What has changed is who can run it and how many victims one operator can run it against at once. A single dashboard now does the work that used to require a skilled attacker’s full attention, all with the help of AI.

Here is what we found, in sum:

Two new Phishing-as-a-Service kits. Both present as legitimate SaaS products, complete with pricing pages, dashboards, and tiered operator accounts. Both are operator consoles for managing stolen Microsoft 365 identities at scale.

Vibe-coded with AI. Both kits show clear signs of AI-assisted development, down to the code structure and the tell-tale AI em dash left in the comments. This is how attackers now build faster, more capable tooling.

No new techniques but industrialised scale. Device code phishing, FOCI pivoting, PRT theft, Windows Hello (NGC) persistence, ESTS cookie generation, and CAP bypass are all publicly documented. What is new is that one operator can now run all of it against dozens of victims from a single dashboard.

AI-driven fraud was built in. One of the kits uses an AI pipeline to read harvested mailboxes and map an organisation’s payment flows, invoices, and outstanding balances.

Persistence that survives a password reset. By registering a synthetic Windows Hello key, the kits can retain access after a password change. One of the kits even displays a "password change survival rate" metric to operators.

Attacks from inside the real mailbox. Phishing emails are sent from the victim’s genuine Microsoft 365 account, so they pass SPF and DKIM and are nearly indistinguishable from legitimate internal mail.

This is the shift from one skilled attacker targeting one company to Phishing-as-a-Service, where the same capability is packaged, automated, and available to far less skilled operators.

These are the phishing kits we found

The first kit calls itself TokenVault // 2026 . However, due to its Lovable vibecoded feeling, we have named it TokenLover . At first, it looked like a token management service. Its footer proudly states it is "Built on TokenTacticsV2." It has a pricing page, a feature comparison table, and a live support dashboard. It looks, at first glance, like a legitimate SaaS product. It is not.

The other phishing kit we found calls itself Yakhub/Yaksha . When visiting the domain linked to the kit, we were greeted by a login screen and nothing more. However, this kit also has a very vibecoded feeling to the UI (more about that later ;)). And we wanted to keep the running theme in there, so we have dubbed it YaksaLover .

How we found the phishing kits

TokenLover first came onto our radar during an incident response case. Investigating a device code phishing incident, we traced the IP behind the initial sign-in and ran it through Shodan, which pointed us to a domain hosted on that same IP. The domain served up a page dressed as a legitimate Azure token management service: pricing tiers, marketing copy, the works. Then we lifted the hood.

Image 1. The TokenLover phishing kit pretends to be a legitimate service to throw defenders off guard

We identified YaksaLover in the exact same way as TokenLover. This phishing kit has a email client built in and is in some aspects more developed than TokenLover, but in some aspects very lacking. When visiting the URL of the kit, we encountered a login screen. But that login screen wouldn’t stop us from diving deeper, and diving deeper we did.

TokenVault/TokenLover

TokenLover is an operator console , the backend that an attacker uses to manage everything from setting up device code phishing campaigns and adding persistence to using AI to exfiltrate data. Think of it as a CRM for stolen Microsoft identities, with a campaign manager, an AI analyst, and a post-exploitation automation engine bolted on.

Image 2. A look at the TokenLover console

The operator panel supports multiple tiers of users: administrators who manage the platform, operators who run...