Loading malware…
Sneaky2FA is an adversary-in-the-middle phishing kit associated with phishing-as-a-service operations targeting enterprise Microsoft 365 accounts. It impersonates Microsoft authentication pages to harvest corporate credentials and intercept authenticated sessions in real time, enabling attackers to bypass multi-factor authentication protections through session hijacking. The kit supports Browser-in-the-Browser functionality, displaying a simulated browser window and address bar within a webpage to make fraudulent authentication prompts appear legitimate.
Sneaky2FA phishing pages have been hosted on Firebase Cloud Storage and AWS CloudFront, leveraging trusted cloud infrastructure to complicate reputation-based detection. Email campaigns have also delivered victims through the Bulletproof blind redirector framework, which uses compromised legitimate websites and document-themed intermediate pages to conceal downstream phishing destinations from email security controls. These redirector capabilities belong to the delivery framework rather than necessarily to Sneaky2FA itself. Targeting centers on corporate Microsoft 365 users; no specific industry focus or named threat-actor attribution is established.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
This kit defeats URL reputation checks that secure email gateways (SEG) perform on the email’s Call-to-Action links.
Emails contain a link to go.php on that site, with a short ?c= campaign token as the only parameter
The fetched content is generally a credential-harvesting page impersonating a widely used login such as Microsoft 365, Google Workspace or Adobe.
[AiTM portals] capture the resulting session token, and thereby defeat multifactor authentication.
[AiTM portals] capture the resulting session token.
Increasingly these pages are not simple clones but adversary-in-the-middle (AiTM) portals: they relay what the victim types to the real login service in real time.
Sneaky2FA relayed live authentication sessions between a victim and Microsoft's real login servers, letting the operator capture both credentials and session tokens as they passed through, which is what let the kit defeat MFA rather than just harvest a password.
The fetched content is generally a credential-harvesting page impersonating a widely used login such as Microsoft 365, Google Workspace or Adobe.
Increasingly these pages are not simple clones but adversary-in-the-middle (AiTM) portals: they relay what the victim types to the real login service in real time.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.