AI phishing as a service: Abnormal AI finds Athena StealthRoute

The platform has its own AI studio

Abnormal AI first found infrastructure linked to the platform during a phishing campaign in August 2026.

Its AI Studio has six task workflows: Email Writer, Subject Lines, Attachment Generator, White Page, AI Coder and Paraphrase. The White Page tool writes harmless looking pages that can be used as cover.

The recovered code does not show which AI models or which AI provider the platform uses.

Security scanners can see a different page from victims

The platform checks each visitor first. A visitor who fails its checks may get an error page or be sent to an unrelated, legitimate website. So a security analyst who checks a phishing link may see something different from what the intended victim sees.

Abnormal says this mix of cloaking and custom wording shows the limits of checking single messages or links.

The research counts targets in the US and EU

In the six months to 9 October 2026, Abnormal saw about 89,700 attack-flagged messages across roughly 2,280 organisations in the US and EU. The research does not name the UK.

The NCSC judged that attackers are almost certainly already using AI to help with social engineering, among other steps. To 2027, it expects AI to increase the volume and impact of intrusions by improving existing methods, not by creating new ones.

For UK organisations, the NCSC's layered advice still applies

The NCSC says phishing defences often put too much weight on users spotting phishing emails. It says some phishing attacks will always get through, so organisations should plan for incidents.

Its guidance sets out four layers of defence. It advises DMARC, SPF and DKIM, so that email from your domains is harder to fake. It advises multi-factor authentication, so that a stolen password alone does not open an account.

It also advises checking important email requests through a second channel, such as a phone call. And it advises against a culture of blame around phishing.

What happens next

Abnormal says a further threat intelligence report will look at the platform's infrastructure, attack activity and defences in more detail.

In the UK, the NCSC asks people to forward emails they are not sure about. It wants them even when people are not certain they are a scam.