Sometimes, it only takes a few clicks on a suspicious link for your email account to be compromised. Cybercriminals are using ready-made tools, known as phishing kits, to trick users into revealing sensitive information. These kits are often designed to mimic legitimate websites, such as email login pages, to deceive users into entering their credentials. One such phishing method, called CodeStorm, was recently uncovered by the cybersecurity firm Hexastrike. It is a type of man-in-the-middle (MITM) or adversary-in-the-middle (AiTM) attack that targets users of Microsoft 365. The goal is to bypass two-factor authentication, a security measure that typically requires both a password and a second form of verification, such as a code sent to a phone. This technique, while not new, has been refined and is now being used more effectively by hackers. During cybersecurity testing, researchers captured and analyzed a phishing kit that operates on the same principle as the CodeStorm attack. This kit is designed to intercept and capture login credentials without triggering alarms on standard security systems. The malicious code is crafted to avoid detection by antivirus programs and other security tools, making it harder for users to realize they have been targeted. Understanding how these phishing kits work is essential for improving online security. By analyzing the code, cybersecurity experts can develop better defenses and raise awareness about the dangers of clicking on suspicious links. Users are encouraged to verify the authenticity of any login page before entering their credentials and to enable additional security measures, such as multi-factor authentication, wherever possible.