About MOUNT10 Blog Phishing-as-a-Service

The growing danger from phishing-as-a-service

The security landscape is changing rapidly, and companies as well as private individuals are facing an increasingly complex threat: the theft of login credentials. According to recent reports, over 85 per cent of phishing attacks in 2024 were aimed at precisely this target. By 2025, this number could even rise to over 90 per cent - an alarming trend that underlines the urgency of effective security measures.

Phishing-as-a-Service: A new dimension of cybercrime

One of the driving forces behind this development is the concept of Phishing-as-a-Service (PhaaS). This is a model in which cybercriminals can purchase ready-made phishing kits or services on the black market to carry out targeted attacks. These kits are designed to bypass security barriers and deceive users in order to obtain sensitive data such as passwords or login details.

More worryingly, new advanced PhaaS kits could also aim to compromise multifactor authentication(MFA) credentials in the next twelve months. MFA is currently considered one of the most reliable measures for preventing unauthorised access. A successful attack on these protection mechanisms would put companies and users in an even more precarious position.

PhaaS: A growing proportion of cyber attacks

According to a recent analysis, PhaaS-based attacks currently account for around 30 per cent of cyberattacks aimed at data theft. This figure not only emphasises the increasing popularity of these services among cyber criminals, but also the danger they pose. The easy availability of PhaaS kits lowers the barriers to entry for attackers and ensures that even less experienced hackers can carry out complex and effective attacks.

Here are some measures that companies and private individuals can take:

Awareness raising and training

You and your employees should be regularly informed about the latest phishing methods so that you can better recognise suspicious emails or links.

Strong authentication

The implementation of multi-factor authentication remains an important protection mechanism, even if attackers are increasingly trying to circumvent it.

Immutable Backup

Invest in a professional backup that cannot be changed – neither by hackers nor by careless employees. With an immutable backup, you can ensure that your data remains accessible at all times and effectively protect your company against risks such as blackmail, data loss, downtime and more.
Rely on a solution that guarantees security and reliability – for uninterrupted business operations, even in an emergency.

Monitoring and analysis

Use modern security solutions (IDS / EDR / SIEM) that can monitor, analyse and immediately block suspicious behaviour in real time. This allows you to identify potential phishing attacks at an early stage and prevent damage before it occurs.

Regular software updates

Update your systems to close security gaps that could be exploited by phishing attacks.

Zero trust approach

Rather than relying on conventional security models, rigorously check every access to your systems.

Credential theft remains one of the biggest challenges in the cyber security world. The growing threat of phishing-as-a-service shows how important it is to act proactively and optimise security measures on an ongoing basis. Companies and individuals who react to these developments early on have the best chance of protecting their data, even in an increasingly complex threat landscape.