Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Rockstar2FA is (or perhaps was) a PaaS kit that mimics legitimate credential-request behavior of commonly used cloud and software-as-a-service platforms. Would-be cybercriminals purchase and control phishing campaigns through Telegram and are given a unique phishing page and URL to use in their campaign.
Visitors to the URL would be routed to a counterfeit Microsoft login page. That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page.
In this case, the same IP address utilized for the credential harvesting was also used for the authentication to the user account, based on EntraID sign-in logs... the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.
Visitors to the URL would be routed to a counterfeit Microsoft login page. That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page.
In this case, the same IP address utilized for the credential harvesting was also used for the authentication to the user account, based on EntraID sign-in logs... the EnteraID log for a sign-in by the adversary-in-the-middle script on the phishing service’s back-end server.
That page captured credentials and multifactor authentication tokens and sent them via an HTTP POST message to an adversary-controlled “backend server” page —a PHP page with a seemingly random number for its name... In this case, the same URL to send an authentication request for the target as used in communication requests to the “backend portal”—in this case, to a backend server utilizing the file “next.php”.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this malware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.