Barracuda has released details of a new stealthy, evasive phishing-as-a-service (PhaaS) kit that hides malicious content within web page iframes to evade detection and maximize resilience. This is the first time Barracuda has detected a complete phishing framework built around the iframe technique. Threat analysts have been monitoring the new PhaaS since September 2025 and have dubbed it GhostFrame . To date, over a million attacks have been attributed to this kit. Barracuda’s technical analysis shows that GhostFrame’s functionality is deceptively simple, yet highly effective. Unlike most phishing kits, GhostFrame uses a simple, seemingly innocuous HTML file, with all the malicious activity