New Phishing Service Uses AI to Write Convincing Lures and Hide From Security Scanners

A new phishing-as-a-service platform called Athena StealthRoute is using AI tools to both deliver and conceal phishing attacks, according to researchers at Abnormal AI. The firm first identified infrastructure linked to the platform during an August 2026 phishing campaign. In the six months to October 9, it found about 89,700 attack-related messages containing the platform's distinctive link pattern, spread across roughly 2,280 organisations in the US and Europe.

At the centre of the platform is an AI Studio with six specialised workflows. Five focus on creating phishing lures and supporting materials tailored to different pretexts and audiences, so criminals do not have to write every message from scratch. The sixth, called White Page, produces benign-looking decoy content. It can act as a cover when the platform's cloaking layer steers security scanners and other unwanted visitors away from the malicious destination.

The wider platform also offers a marketplace for campaign materials, domain and link management, visitor monitoring and cloaking controls. Athena StealthRoute still relies on external infrastructure to harvest credentials and tokens, but much of the preparation and delivery can be managed from a single console. Abnormal AI said this combination of cloaking and customisable content shows the limits of relying on individual messages or link inspections to spot phishing.