Link inspection assumes a URL has one answer. Either it serves a credential page or it does not. A platform that serves a benign article to a scanner and a fake login page to a target breaks that assumption, and it does so without needing a novel exploitation technique. Abnormal AI described one such platform this week under the name Athena StealthRoute.

The researchers first saw infrastructure linked to the platform during a phishing campaign in August 2026. In the six months to October 9, they identified roughly 89,700 attack-related messages carrying the platform's distinctive link pattern, reaching about 2,280 organisations in the United States and Europe.

What is sold as a service

The console combines domain and link management, a marketplace for campaign materials, visitor monitoring and cloaking controls. Credential and token harvesting still happen in separate downstream services, so the platform does not itself steal anything. What it packages is the preparation and delivery layer that used to require an operator who could write convincing copy and keep a cloaking setup running.

That packaging is the change worth tracking. A commodity phishing kit sells a page. This platform sells the workflow around the page: which visitors see it, what a scanner sees instead, and what the lure says.

The AI Studio

The AI Studio contains six task-specific workflows. Five of them produce phishing lures and supporting materials, so an operator can request copy tailored to a pretext and an audience instead of starting from a template or writing it by hand.

The sixth is the one that matters for detection. Abnormal AI calls it the White Page option, and it generates structured, benign-looking content that serves as cover when the cloaking layer diverts scanners and other unwanted visitors away from the malicious destination. The decoy is not an empty page or an error. It is content that looks like a plausible destination for the link.

The result is a campaign where the message text, the page a human sees and the page a scanner sees are three separate artefacts, all controlled from one console.

Why per-message detection struggles

Two properties interact here.

Cloaking means the destination observed by a security scanner is not the destination the target reaches. Any control that follows a link once, from a data-centre IP range, and decides based on the result is answering a question the attacker chose.

Variation in lure copy means exact-match detection on wording has less to hold onto. If five workflows generate the text and an operator can request different pretexts, the phrase that identifies this week's campaign is not the phrase that identifies the next one.

The researchers' conclusion follows from that: individual message and link inspection has limits against this design, and defenders need signals that survive changes in domains and copy.

Signals that survive

Abnormal AI points to three categories of infrastructure evidence, and each of them is independent of the lure.

Shared backend infrastructure is the first. Campaigns that rotate domains still tend to reach the same origin, because the operator pays for one platform. Grouping observed URLs by resolved infrastructure, certificate reuse or hosting patterns can reconnect a campaign after the front-end domain has changed.

Matching operator-console code is the second. The console is a product, and its client-side code is more stable than the domains the operator buys. Identical or near-identical script artefacts across unrelated domains are a stronger link than a shared lure phrase.

Recognisable link structures are the third. The researchers describe a distinctive link pattern in the messages they counted, which is what allowed attribution of roughly 89,700 messages across 2,280 organisations to one platform. That pattern is a detection surface, though a fragile one if the operator changes it.

The investigation the platform forces

Because credential and token harvesting happen downstream, an investigation that stops at the phishing domain stops before the part that matters. The question after a reported message is what the target did after clicking: whether a session token was issued, whether it was replayed elsewhere, and which downstream service received it.

That reframing has a practical consequence for triage. A user who reports a suspicious message and did not click needs no further action on the identity side. A user who clicked needs their sessions examined, not only their password reset, because the harvesting step is separate and the platform was never in the credential business itself.

The other consequence concerns what to count. If scanners see decoy content, then a low detections figure from automated link analysis is not evidence that a campaign is small. The 89,700-message estimate came from Abnormal AI's own telemetry and link-pattern analysis, which measures something different from a scanner hit rate.

References

[1] Infosecurity Magazine, "New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity", October 21, 2026. https://www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/