New ‘Sneaky 2FA’ Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass

Summary: Cybersecurity researchers have unveiled a new phishing kit, named Sneaky 2FA, designed to target Microsoft 365 accounts and steal credentials along with two-factor authentication codes. This kit operates as phishing-as-a-service (PhaaS) and has been linked to a cybercrime service called ‘Sneaky Log,’ with nearly 100 domains identified hosting its phishing pages. The kit employs advanced anti-bot measures and deceptive tactics to lure victims into providing sensitive information.

Threat Actor: Sneaky Log | Sneaky Log
Victim: Microsoft 365 users | Microsoft 365 users

Keypoints :

• The Sneaky 2FA phishing kit is marketed as a subscription service for $200 per month, allowing customers to independently deploy the obfuscated source code.
• It utilizes compromised WordPress sites to host phishing pages that automatically populate victims’ email addresses, enhancing the kit’s legitimacy.
• Advanced techniques, such as traffic filtering and User-Agent string manipulation, are employed to evade detection and ensure only targeted victims are directed to the credential harvesting pages.