New GhostFrame Super Stealthy Phishing Kit Attacks Millions of Users Worldwide

A new phishing kit, GhostFrame, has been identified as the cause of over 1 million attacks worldwide. Discovered in September 2025 by Barracuda's security researchers, GhostFrame signifies a significant advancement in phishing-as-a-service technology.

GhostFrame is notable for its combination of simplicity and effectiveness. It utilizes an HTML file with an embedded iframe to conceal malicious activities. This method makes detection by security tools challenging.

The phishing kit operates in two stages. Initially, potential victims receive phishing emails with misleading subject lines, such as “Secure Contract & Proposal Notification” or “Password Reset Request.” Upon clicking the link, users are directed to a seemingly benign webpage. However, an iframe on this page loads the actual phishing content from a dynamic subdomain.

To further evade detection, each target is assigned a unique subdomain. GhostFrame also incorporates anti-analysis features, disabling right-click, keyboard shortcuts, and developer tools to hinder security inspection.

The phishing form is hidden within an image-streaming function, bypassing standard security scans. The kit can switch subdomains during active sessions and includes backup iframes for scenarios where JavaScript is disabled. GhostFrame also has the capability to mimic legitimate services, adjusting page titles and favicons accordingly.

Regular browser updates Email security gateways to detect suspicious iframes Controls to restrict iframe usage Employee training to verify URLs and report suspicious content

Organizations must adopt a multi-layered defense strategy to mitigate the risk posed by GhostFrame. Comprehensive email security solutions are critical to safeguarding users against this evolving threat.

Based on reporting by Cyber Security News.