Loading threat actor…
Whisper 2FA is a phishing-as-a-service toolkit used to target Microsoft accounts and bypass multi-factor authentication. It emerged in 2025 as a prominent successor and competitor in the 2FA-phishing ecosystem, becoming one of the most common PhaaS offerings after disruption of Tycoon 2FA infrastructure. The kit is designed for rapid deployment and emphasizes lightweight operation, using AJAX-based exfiltration rather than more complex reverse-proxy architectures. Reported MFA bypass support includes push notifications, SMS, voice calls, and app-based authentication codes. Whisper 2FA has been associated with large-scale phishing campaigns, including close to one million observed attacks against Microsoft accounts in a single month. It is part of a broader criminal ecosystem in which phishing kits are redistributed, cloned, and iteratively improved by operators and affiliates. Its rise has been linked to diversification in the phishing market following law-enforcement pressure on other major kits. Operationally, Whisper 2FA is characterized by anti-analysis obfuscation and fast-turnaround deployment suited to high-volume credential harvesting. Its role in MFA bypass and account compromise indicates support for credential theft and post-authentication abuse. Known aliases include whisper_2fa and whisper_2fa_operators.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newer phishing platform described as an aggressive newcomer that expanded activity after Tycoon 2FA's disruption.
Whisper 2FA is a phishing kit focused on rapid deployment and multi-factor authentication bypass, using lightweight exfiltration and strong obfuscation.
Operate Whisper 2FA phishing kit to steal credentials and MFA tokens from Microsoft account users in large-scale phishing campaigns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.