ATHENA-STEALTHROUTEAthena StealthRoute

Athena StealthRoute is a modular phishing-as-a-service (PhaaS) platform reported by Abnormal AI in October 2026. Rather than harvesting credentials or tokens itself, it prepares, delivers and conceals phishing campaigns: a marketplace for campaign materials, domain and link management, traffic-filtering and cloaking controls that divert security scanners, and an 'AI Studio' with six workflows generating tailored messages, subject lines, attachments and benign decoy pages; credential and token harvesting relies on separate downstream services. Linked infrastructure was first identified in August 2026, and about 89,700 messages matching its link pattern were observed across roughly 2,280 organizations in the U.S. and E.U. over the six months to 9 October 2026. It is unrelated to the Athena malware family listed in malpedia. No threat actor is attributed.