A new phishing phishing-as-a-service (PhaaS) platform, dubbed Athena StealthRoute, has been found to use AI tools to both deliver and conceal phishing attacks.

Researchers at cybersecurity firm Abnormal AI first identified Athena StealthRoute-linked infrastructure during an August 2026 phishing campaign.

In the six months to October 9, the firm identified approximately 89,700 attack-related messages containing the platform's distinctive link pattern across around 2,280 organizations in the US and Europe.

Read more: Phishing Dominates as Initial Entry Method for Cyber-Attacks

Of note is the platform’s AI Studio, which offers six specialized workflows for requesting customized phishing lures, supporting materials and benign-looking decoy content.

The broader Athena StealthRoute platform includes a marketplace and link-cloaking capabilities designed to divert security scanners away from malicious destinations.  

The researchers noted that Athena StealthRoute illustrates how much of a phishing operation can be packaged and sold as a service without performing credential or token theft itself.

Abnormal AI noted that the AI Studio gives threat actors another way to prepare phishing content without writing every lure from scratch or relying exclusively on ready-made materials. They can instead request content tailored to different pretexts and audiences.

AI Studio is integrated into Athena StealthRoute's broader offering, which also combines domain and link management, a marketplace for campaign materials, visitor monitoring and cloaking controls.

Athena StealthRoute still relies on external infrastructure for credential and token harvesting, but much of the preparation and delivery workflow can be managed through a single console, the researchers noted.

Five of the six offerings in the AI Studio focus on the creation of phishing lures and related materials. However, the sixth option extends to decoy content intended to conceal the phishing attempts. The White Page option produces structured, benign-looking content that could be used as a cover when Athena StealthRoute's cloaking layer directs scanners and other unwanted visitors away from malicious destinations.

How to Detect and Defend Against Athena StealthRoute 

Abnormal AI said that for defenders, the platform’s combination of cloaking and customizable content reinforces the limitations of relying on individual messages or link inspections to detect phishing attempts.

“Security scanners may encounter benign content where intended victims would reach malicious destinations, while variations in lure copy can make exact wording less useful for linking-related attacks,” the researchers said in their analysis.

Shared backend infrastructure, matching operator-console code and recognizable link structures offer additional signals for identifying Athena StealthRoute-associated activity even as individual domains and lures change.

Finally, because credential and token harvesting occur through separate downstream services, investigations must also account for the particular theft mechanism involved.