Feed aggregator

ATHENS, Ohio (WCMH) — The Athens community is still buzzing after the U.S. women's hockey team defeated Canada for the gold medal on Thursday, especially because one of Team USA's players is from Athens. “Everybody is so happy for her and so proud that somebody from Athens was able to do something like that," said [...]

COLUMBUS, Ohio (WCMH) -- The Winter Olympics are not the only place to see ice skating in action. Disney on ice is back here in Columbus at Nationwide Arena.   Disney on Ice is presenting “Mickey's Search Party.” The show will feature numbers from classics like The Little Mermaid and Beauty and the Beast.   “It's very special,” Shay [...]

COLUMBUS, Ohio (WCMH) -- An officer who was acquitted in the death of a 21-year-old pregnant woman has agreed to part ways with the Blendon Township Police Department. Officer Connor Grubb will resign from the department and be paid $150,000 to cover any lost benefits and potential backpay, according to a township spokesperson. Blendon Township [...]

MILAN, Italy (WCMH) -- As the United States men's hockey team continues its pursuit of its first Olympic medal since 2010, the memory of former Blue Jacket Johnny Gaudreau lives on in the Americans' locker room. "He's probably a guy that would've been here," Blue Jackets and U.S. defenseman Zach Werenski said. Gaudreau's No. 13 [...]

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and then acts as a relay between the target and the legitimate site — forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

There are countless phishing kits that would-be scammers can use to get started, but successfully wielding them requires some modicum of skill in configuring servers, domain names, certificates, proxy services, and other repetitive tech drudgery. Enter Starkiller, a new phishing service that dynamically loads a live copy of the target login page and records everything the user types, proxying the data to the legitimate site and back to the victim.

According to an analysis of Starkiller by the security firm Abnormal AI, the service lets customers select a brand to impersonate (e.g., Apple, Facebook, Google, Microsoft et. al.) and generates a deceptive URL that visually mimics the legitimate domain while routing traffic through the attacker’s infrastructure.

For example, a phishing link targeting Microsoft customers appears as “login.microsoft.com@[malicious/shortened URL here].” The “@” sign in the link trick is an oldie but goodie, because everything before the “@” in a URL is considered username data, and the real landing page is what comes after the “@” sign. Here’s what it looks like in the target’s browser:

Image: Abnormal AI. The actual malicious landing page is blurred out in this picture, but we can see it ends in .ru. The service also offers the ability to insert links from different URL-shortening services.

Once Starkiller customers select the URL to be phished, the service spins up a Docker container running a headless Chrome browser instance that loads the real login page, Abnormal found.

“The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site’s responses,” Abnormal researchers Callie Baron and Piotr Wojtyla wrote in a blog post on Thursday. “Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way.”

Starkiller in effect offers cybercriminals real-time session monitoring, allowing them to live-stream the target’s screen as they interact with the phishing page, the researchers said.

“The platform also includes keylogger capture for every keystroke, cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in,” they wrote. “Campaign analytics round out the operator experience with visit counts, conversion rates, and performance graphs—the same kind of metrics dashboard a legitimate SaaS [software-as-a-service] platform would offer.”

Abnormal said the service also deftly intercepts and relays the victim’s MFA credentials, since the recipient who clicks the link is actually authenticating with the real site through a proxy, and any authentication tokens submitted are then forwarded to the legitimate service in real time.

“The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.”

The “URL Masker” feature of the Starkiller phishing service features options for configuring the malicious link. Image: Abnormal.

Starkiller is just one of several cybercrime services offered by a threat group calling itself Jinkusu, which maintains an active user forum where customers can discuss techniques, request features and troubleshoot deployments. One a-la-carte feature will harvest email addresses and contact information from compromised sessions, and advises the data can be used to build target lists for follow-on phishing campaigns.

This service strikes me as a remarkable evolution in phishing, and its apparent success is likely to be copied by other enterprising cybercriminals (assuming the service performs as well as it claims). After all, phishing users this way avoids the upfront costs and constant hassles associated with juggling multiple phishing domains, and it throws a wrench in traditional phishing detection methods like domain blocklisting and static page analysis.

It also massively lowers the barrier to entry for novice cybercriminals, Abnormal researchers observed.

“Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling,” their report concludes. “Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.”

The Federal Communications Commission (FCC) is looking for qualified applicants for Field Agents in seven Enforcement Bureau (EB) offices across the United States: Atlanta, GA; Boston, MA; Chicago, IL; Dallas, TX; New Orleans, LA; New York, NY, and Portland, OR. Incumbents will resolve Radio Frequency (RF) interference, educate users, and enforce regulations. The GS levels for this position hav...

COLUMBUS, Ohio (WCMH) -- The U.S. Department of Justice has sued OhioHealth, alleging the health care provider is limiting competition and driving up costs for patients. The lawsuit accuses OhioHealth of restricting "commercial health insurers from offering health plans that allow patients to share in the savings that come from choosing OhioHealth's lower-cost rivals." OhioHealth, [...]

Central Ohio Catholic churches are offering meatless meals, such as fish fries, to those observing Lent from February 20th to March 27th.

Solar activity returned to low levels this past week. The strongest
event of the period was a C1.8 flare on February 17 from region
4374. This region was also responsible for a C1.4 flare on February
18. The only other flare of note was a C1.1 flare on February 17
from an unnumbered plage region near S05E85. (A plage region is a
bright, intensely hot region in the Sun's chromosphere, typically
found ...

ARRL The National Association for Amateur Radio®’s new book, Digital Networking for Ham Radio, a practical, hands-on guide to designing and implementing high-speed data networks for amateur radio stations, is now shipping.

Written by Glen Popiel, KW5GP, the book brings together in one comprehensive resource the knowledge needed to build, configure, and expand digital networks for ham radio. From...

COLUMBUS, Ohio (WCMH) — A suspect believed to be involved in a 13-year-old homicide who was arrested near Dayton after a police shootout two years ago, has been extradited to Columbus to face murder charges. Breyon Bryant, who was wanted in the 2013 strangulation death of Daivena Clay, is in a Franklin County courtroom Friday [...]

ARRL The National Association for Amateur Radio® announced the winner of the 2025 ARRL Sweepstakes Icom® Dream Station on Saturday, February 14, at 2026 Orlando HamCation. The announcement was made by ARRL President Rick Roderick, K5UR, with Icom America Senior Sales Manager Ray Novak, N9JA.

The ARRL Sweepstakes ran from January 3 to December 31, 2025, as the centerpiece of a year-long membershi...

COLUMBUS, Ohio (WCMH) -- Ohio State University's student support center Buckeye Commons, which replaced a former student center that was discontinued when the university ended diversity programming, will get a new look this summer. Buckeye Commons replaced the former Student Life's Center for Belonging and Social Change after OSU eliminated diversity programs in February 2025. [...]

COLUMBUS, Ohio (WCMH) – Ohio is among the states where residents have experienced the highest levels of exhaustion so far this year, a recent study suggests. The nutrition and wellness brand Juice Plus examined Google search data across all 50 states for more than 100 commonly used terms related to physical, mental, sleep and nutritional [...]

COLUMBUS, Ohio (WCMH) -- A more than 100-year-old building in Franklinton is entering a new chapter as a multipurpose venue under the Columbus Association for the Performing Arts. The organization announced Thursday that it has signed a lease with the city of Columbus and assumed operational control of the Idea Foundry at 421 W. State [...]

COLUMBUS, Ohio (WCMH) – Ohio has increased its efforts to prevent the spread of the invasive spotted lanternfly. The Ohio Department of Agriculture issued a statewide quarantine for the species on Tuesday. Previously, 18 out of the state’s 88 counties were under quarantine, including Franklin County. A quarantine restricts the shipment of items that could [...]

NEW ALBANY, Ohio (WCMH) -- House Oversight Democrats said their closed-door deposition with Ohio billionaire Les Wexner was the first time he was being federally questioned regarding his former relationship with convicted sex offender Jeffrey Epstein. “(Wexner is) someone that’s been named by survivors, someone that’s in the files more than most people, someone that’s [...]

COLUMBUS, Ohio (WCMH) -- Happy Friday as we begin the process of ending the Milan Cortina Olympics, but not before more medal events and men's hockey games for Day 14. Team USA meets Slovakia for a spot in Sunday's gold medal game at 3 p.m. on NBC4. Canada and Finland will meet in the other [...]