FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation

Reported 18 May 2026 by otx · Severity: medium

FlowerStorm is a widely known Phishing-As-A-Service (PhaaS) attack kit that has been active since at least mid-2024, increasingly in large scale campaigns. FlowerStorm performs targeted, complex collection of a victim’s credentials, including the management of multi-factor authen