# AI phishing as a service: Abnormal AI finds Athena StealthRoute

A kit that writes phishing emails with AI and shows scanners a harmless page is a reminder that defences cannot rest on staff alone.

The Assurance Desk, news. Published 23 October 2026.

Abnormal AI published research on 21 October 2026 about Athena StealthRoute, a phishing as a service platform. It prepares, delivers and conceals phishing attacks for the people who buy it. The platform does not steal passwords itself. Separate services do that part ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

## The platform has its own AI studio

Abnormal AI first found infrastructure linked to the platform during a phishing campaign in August 2026 ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

Its AI Studio has six task workflows: Email Writer, Subject Lines, Attachment Generator, White Page, AI Coder and Paraphrase. The White Page tool writes harmless looking pages that can be used as cover ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

The recovered code does not show which AI models or which AI provider the platform uses ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

## Security scanners can see a different page from victims

The platform checks each visitor first. A visitor who fails its checks may get an error page or be sent to an unrelated, legitimate website. So a security analyst who checks a phishing link may see something different from what the intended victim sees ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

Abnormal says this mix of cloaking and custom wording shows the limits of checking single messages or links ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

## The research counts targets in the US and EU

In the six months to 9 October 2026, Abnormal saw about 89,700 attack-flagged messages across roughly 2,280 organisations in the US and EU. The research does not name the UK ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

The NCSC judged that attackers are almost certainly already using AI to help with social engineering, among other steps. To 2027, it expects AI to increase the volume and impact of intrusions by improving existing methods, not by creating new ones ([NCSC, Impact of AI on cyber threat from now to 2027](https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027), checked 23 October 2026).

## For UK organisations, the NCSC's layered advice still applies

The NCSC says phishing defences often put too much weight on users spotting phishing emails. It says some phishing attacks will always get through, so organisations should plan for incidents ([NCSC, Phishing attacks: defending your organisation](https://www.ncsc.gov.uk/guidance/phishing), checked 23 October 2026).

Its guidance sets out four layers of defence. It advises DMARC, SPF and DKIM, so that email from your domains is harder to fake. It advises multi-factor authentication, so that a stolen password alone does not open an account ([NCSC, Phishing attacks: defending your organisation](https://www.ncsc.gov.uk/guidance/phishing), checked 23 October 2026).

It also advises checking important email requests through a second channel, such as a phone call. And it advises against a culture of blame around phishing ([NCSC, Phishing attacks: defending your organisation](https://www.ncsc.gov.uk/guidance/phishing), checked 23 October 2026).

**The NCSC's four layers of phishing defence**

- Make it difficult for attackers to reach your users, for example with DMARC, SPF and DKIM
- Help users identify and report suspected phishing messages, and check important requests through a second channel
- Protect your organisation from phishing emails that get through, for example with multi-factor authentication
- Respond quickly to incidents

From the NCSC guidance for organisations. No single layer stops every phishing email, so the guidance asks for some measures in each layer.

Source: NCSC, Phishing attacks: defending your organisation, https://www.ncsc.gov.uk/guidance/phishing (checked 23 October 2026)

## What happens next

Abnormal says a further threat intelligence report will look at the platform's infrastructure, attack activity and defences in more detail ([abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools](https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai), checked 23 October 2026).

In the UK, the NCSC asks people to forward emails they are not sure about. It wants them even when people are not certain they are a scam ([NCSC, Phishing scams: how to spot and report them, Report a scam email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email), checked 23 October 2026).

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- abnormal.ai, Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools: https://abnormal.ai/blog/athena-stealthroute-phishing-marketplace-cloaking-ai (checked 23 October 2026)
- NCSC, Impact of AI on cyber threat from now to 2027: https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027 (checked 23 October 2026)
- NCSC, Phishing attacks: defending your organisation: https://www.ncsc.gov.uk/guidance/phishing (checked 23 October 2026)
- NCSC, Phishing scams: how to spot and report them, Report a scam email: https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.