Malware

Mamba 2FA

Mamba 2FA is an adversary-in-the-middle (AiTM) phishing-as-a-service framework targeting cloud authentication, particularly Microsoft 365. It began appearing in phishing operations around 2023 and remained widely used in 2025. It provides cybercriminal operators with realistic authentication-page emulation, automated session handling, and real-time backend communication to facilitate credential theft and bypass conventional multifactor authentication.

Its phishing interfaces imitate Microsoft sign-in pages and incorporate organization-specific branding. An observed workflow presents an authentication loading screen followed by a password-only prompt, creating the impression that the victim’s identity has already been established. Client-side JavaScript captures password input and prepares it for transmission. After submission, the browser redirects to a legitimate website to reduce suspicion.

Mamba-associated campaigns use email lures impersonating Microsoft security alerts, document notifications, and account-activity warnings. Distribution includes embedded phishing links, branded HTML emails, and attached email messages. Encoded link parameters, short-lived phishing addresses, and redirect chains help conceal operational details and reduce detection by reputation-based filtering. Its primary focus is enterprise cloud identity rather than a specific endpoint operating system.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence2

Security experts have issued a warning about the continued risk of Tycoon 2FA attacks... Before the takedown, Tycoon 2FA was behind tens of millions of phishing messages, reaching over 500,000 organizations each month worldwide.

T1566.001Spearphishing AttachmentEvidence1

Use of HTML email bodies or attached message files to preserve branding and formatting

T1566.002Spearphishing LinkEvidence1

Embedded hyperlinks leading directly to the phishing page, often with encoded parameters

Execution

1 technique

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

MITRE FRAMEWORK Tactic Technique ID Technique Name ... Defense Evasion T1127 Trusted Developer Utilities Proxy Execution

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence2

The encoded parameter contains a long, non-human-readable string, indicative of obfuscation and runtime data passing.

T1127Trusted Developer Utilities Proxy ExecutionEvidence1

MITRE FRAMEWORK Tactic Technique ID Technique Name ... Defense Evasion T1127 Trusted Developer Utilities Proxy Execution

Credential Access

6 techniques

T1056Input CaptureEvidence1

Collection T1056 Input Capture

T1056.003Web Portal CaptureEvidence1

The password field is monitored by client-side JavaScript. Input handling occurs within the browser, preparing the entered credentials for transmission immediately upon submission.

T1110.004Credential StuffingEvidence1

MITRE FRAMEWORK Tactic Technique ID Technique Name ... Credential Access T1110.004 Brute Force: Credential Stuffing

T1528Steal Application Access TokenEvidence1

Collectively, these trends reinforce the ongoing threat posed by AiTM phishing kits to enterprise cloud environments and underscore the need for continuous monitoring and adaptive defensive controls.

T1539Steal Web Session CookieEvidence1

In the background, however, the attacker captures every step in transit, including the username, password, MFA response, and resulting session cookie. Once that cookie is stolen, it can be replayed to access the account as an authenticated user.

T1557Adversary-in-the-MiddleEvidence1

First spotted in August 2023, it used adversary in the middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

Collection

4 techniques

T1056Input CaptureEvidence1

Collection T1056 Input Capture

T1056.003Web Portal CaptureEvidence1

The password field is monitored by client-side JavaScript. Input handling occurs within the browser, preparing the entered credentials for transmission immediately upon submission.

T1119Automated CollectionEvidence1

Its workflow minimized visible user interaction, reduced friction during authentication, and relied on automation to handle identity context and credential relay.

T1557Adversary-in-the-MiddleEvidence1

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

Upon access, the browser issues an HTTPS GET request to a URL path structured in the format /s/?<base64-encoded-parameter>

T1105Ingress Tool TransferEvidence1

MITRE FRAMEWORK Tactic Technique ID Technique Name ... Command and Control T1105 Ingress Tool Transfer

T1132Data EncodingEvidence1

Command and Control T1132 Data Encoding

Impact

1 technique

T1499.004Application or System ExploitationEvidence1

MITRE FRAMEWORK Tactic Technique ID Technique Name ... Impact T1499.004 Endpoint Denial of Service: Application or System Exploitation

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app31 years ago

ip.v4●●●●●●●●●●●●View more in app31 years ago

domain●●●●●●●●●●●●View more in app31 years ago

ip.v4●●●●●●●●●●●●View more in app31 years ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

itproNews

Apr 17, 2026

Tycoon 2FA is down, but not out - researchers warn the phishing as a service operation is still a huge threat to businesses | IT Pro

An established phishing kit/platform mentioned as increasing campaign activity after the Tycoon 2FA takedown.

cyfirma blogNews

Jan 16, 2026

Mamba Phishing-as-a-Service Kit: How Modern adversary-in-the-middle (AiTM) Attacks Operate - CYFIRMA

A phishing-as-a-service framework designed to facilitate credential theft, session interception, and MFA bypass against cloud identity services, particularly Microsoft 365. The observed flow uses encoded URL parameters, pre-established identity context, organization-branded Microsoft-style password prompts, client-side JavaScript credential capture, and redirection to legitimate websites after submission. Campaigns commonly use email lures and sometimes redirect chains or short-lived URLs. The report assesses session-aware AiTM capabilities, while its described observations primarily demonstrate password capture and authentication-page impersonation.

scworldNews

Jan 8, 2026

Report: Phishing kits dominated major attacks in 2025 | SC Media

A phishing-as-a-service kit used in high-volume phishing campaigns, noted for supporting multifactor authentication (MFA) bypass techniques and enabling more sophisticated, harder-to-detect credential theft workflows.

help net securityNews

Jan 8, 2026

Cybercriminals are scaling phishing attacks with ready-made kits

A phishing kit focused on bypassing multi-factor authentication (MFA), used in phishing campaigns.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mamba 2FA