FlowerStorm

FlowerStorm is a phishing as a service platform that bypasses MFA on Microsoft 365 accounts. It was first named in October 2024 and has accounted for a significant proportion of the phishing landscape since then.

Push tracks FlowerStorm as a potential cluster of related phishing kits that share a common lineage. The original reporting in late 2024 identified it as emerging out of Rockstar 2FA (itself believed to be an update of DadSec). Other reporting has also associated FlowerStorm with ODx. In 2026, Push discovered admin panels branded as "SCGX02" on phishing sites that were based on the same FlowerStorm tooling. It is unknown whether all of these kits are separate, but based on shared/re-used tooling, or if they're simply rebrands by the same group.

URL patterns

The typical FlowerStorm landing path is a 5-character mixed-case alphanumeric slug: /4ap74/, /KACn8/, /UwYcv/, /haOuo/, /2jBHO/, /GR1eF/.

Patterns in the domains used in attacks associated with the FlowerStorm kit have evolved over time. 2024 saw a continuation of behaviour observed in the predecessor kit Rockstar 2FA with the use of .com and .ru TLDs. In 2025, there was a big shift towards using country specific second-level domains from the CentralNic registry with .com.de and .it.com accounting for over 45% of domains. Whereas 2026 (though August) has been dominated by the .de TLD.

The .de domain generation algorithm used throughout 2026 is based on concatenation of two to four English dictionary words. For example, trusteddigitalbase[.]de, sharpbranding[.]de and operationalefficiencyhub[.]de.

Anti-bot gate

The anti-bot gate used to protect FlowerStorm phishing pages from automated analysis has had several distinct variations over time, often in parallel to each other. Throughout 2024 to mid-2026 these anti-bot gates were primarily built on top of Cloudflare Turnstile. Starting in summer 2026 there was a noticeable shift away to a custom fake CAPTCHA implementation.

Typical FlowerStorm use of Cloudflare Turnstile

Custom CAPTCHA starting mid-2026

Network traffic

Credentials are relayed to the backend using POSTs to a PHP file. Originally this was /google.php, but this has been randomised over time.

1. do=user-check - Initial handshake.
2. do=check&email=<email> - Responds with account type and tenant branding if valid.
3. do=login&user=<email>&pass=<base64(password)> - Password submission.
4. do=verify&email=&key=&tp=&userInput=<base64(code)> - Second factor authentication.
5. do=checkVerify&token=&user=&service=&tp=&key= - Polled to verify authentication.

Device code phishing link

Starting in April 2026 Push observed the delivery of delivery code phishing attacks using the Kali365 framework, but hosted from domains and infrastructure associated with FlowerStorm. This suggests that there is some form of collaboration or re-use between the two groups, though the exact nature of this association is unknown. Example overlap in domains from May 2026:

• hxxps://kgo-gmbh.motoshopsyamaha[.]com/j5rVL/ - Typical FlowerStorm AITM phishing URL pattern.
• hxxps://lvr0dtxic5.motoshopsyamaha[.]com/l/TZNUl-xDH50 - Typical Kali365 device code phishing URL pattern.

Technical indicators for the phishing page content and communications also match each of the separate tools.