Écran d'ordinateur portable affichant du code dans un éditeur sombre

FlowerStorm + KrakVM: AiTM phishing against Microsoft 365 in 4 steps

Ian-Rémi Lafleur
October 4, 2026
3 min read
1 comments

If your team still opens .html attachments labelled “voicemail” or “unpaid invoice,” read this before the next suspicious email. The FlowerStorm phishing kit (adversary-in-the-middle / AiTM phishing-as-a-service) steals credentials and the MFA session in real time. In April 2026, Sublime Security (STIR) saw FlowerStorm shipping login logic as encrypted bytecode via KrakVM, an open-source JavaScript VM—defeating many static scanners.

Here is the four-step victim journey, then a table comparing OTP/SMS/push with passkeys/FIDO2.

Annotated victim journey (4 steps)

Email received

Short or empty body. Subject / filename: voicemail, vendor credit, unpaid invoice. Attachment .html / .htm. Typical targets: Microsoft 365 / Entra, Hotmail, GoDaddy.

HTML opened

The browser (default for .html) runs KrakVM: encrypted bytecode + Base64, strings __krak_throw, runVM. Clean logic is invisible to scanners that do not execute the file. Adopted within about one month of KrakVM’s public release. No evidence the KrakVM developer is linked to FlowerStorm.

Fake login + MFA relay

Page mimicking Microsoft 365 (or Hotmail / GoDaddy). The kit enumerates MFA methods (Authenticator push, TOTP, SMS, voice) and relays them in real time. Cloudflare Turnstile is often present. Traffic to paths like /next.php.

Session stolen

Credentials + session cookie / token captured. Typical Entra signal: MFA “OK,” then token replay from a different geo / ASN. Sophos has documented FlowerStorm since about December 2024 (after Rockstar2FA disruption).

OTP / SMS / push vs passkeys / FIDO2

Method	Against FlowerStorm (AiTM)	For an SMB
SMS / voice call	Relayable: the code typed on the fake page goes to the attacker.	Avoid as the only factor for Microsoft 365.
App OTP (TOTP)	Also relayable in real time in an AiTM.	Better than SMS; not enough alone against this kit.
Authenticator push	FlowerStorm can show a fake “approve on phone” prompt and relay the choice.	Train people to deny unexpected pushes; migrate to passkeys.
Passkeys / FIDO2	Origin-bound (real domain). A phish site cannot complete the same ceremony. NCSC / Microsoft guidance: better than OTP/SMS against origin phishing.	Priority for admin and critical mailboxes.

Passkeys do not replace caution (don’t open unknown HTML), but they break the “relay MFA on a fake domain” model.

Detection signals (for you or your MSP)

HTML attachments with __krak_throw, runVM, large bytecode + Base64 blobs.
POSTs to /next.php or known FlowerStorm domains (Sublime / Sophos lists).
Entra sign-ins: MFA success then session from an unusual geo/ASN.
Policy: block or quarantine .html/.htm attachments to business mailboxes.

How NeoTech can help

We harden Microsoft 365 (passkeys / FIDO2, anti-phishing policies), filter dangerous attachments, and run automated 24/7 monitoring with on-call technician response. See also our cybersecurity services and Microsoft 365 services.

Book your free cyber check

Want to know whether your Microsoft 365 mailboxes still accept HTML attachments, and where your MFA methods stand? In a short meeting, we prioritize fixes.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Sublime Security — FlowerStorm unleashes the KrakVM (May 14, 2026; April 2026 campaign)
CSO Online — FlowerStorm adopts VM obfuscation
Sophos — FlowerStorm documentation (since ~Dec 2024, post-Rockstar2FA)
Passkey / phishing-resistant guidance: Microsoft Entra and NCSC (prefer FIDO2/passkeys over OTP/SMS)

Photo: Markus Spiske (Pexels).

One thought on “FlowerStorm + KrakVM: AiTM phishing against Microsoft 365 in 4 steps”

Pingback: ASOS hack: your customer messaging tools are at risk