Malware

Sneaky 2FA

Sneaky 2FA is a phishing-as-a-service adversary-in-the-middle kit used to target Microsoft 365 accounts and bypass multi-factor authentication by proxying the legitimate Microsoft sign-in flow in real time. It is associated with credential theft and session theft against enterprise users, including campaigns aimed at organizations in healthcare, education, manufacturing, government, professional services, and enterprise IT functions.

The kit is designed to intercept Microsoft authentication workflows rather than rely on static credential-harvesting pages. Reported capabilities include capture and validation of usernames and passwords, interception of one-time passcodes and other MFA challenges, and theft of authenticated session material that can be reused after login. Observed tradecraft also includes credential validation through legitimate Microsoft APIs, browser-in-the-browser style fake login windows, and redirection to legitimate Microsoft-related pages after capture to reduce victim suspicion.

Sneaky 2FA has been observed in phishing campaigns using trusted redirectors and layered URL wrapping to evade static analysis, as well as anti-bot and anti-analysis controls such as browser fingerprinting, geolocation checks, honeypots, timing checks, mouse-interaction checks, WebGL and canvas inspection, and headless-browser or debugger detection. Researchers have also described mutable loader and routing components wrapped around more stable core phishing modules, indicating ongoing efforts to hinder detection and signature-based tracking.

Campaigns linked to Sneaky 2FA have used Microsoft-themed security alerts and voicemail-style lures delivered through email, including messages sent from compromised third-party SaaS accounts to improve trust and deliverability. The kit has also been discussed as part of a broader ecosystem of Microsoft-focused AiTM and PhaaS platforms alongside EvilProxy, Mamba 2FA, Whisper 2FA, Kali365, EvilTokens, FlowerStorm, and Tycoon 2FA-derived activity. Some reporting refers to the kit as WikiKit.

Sneaky 2FA is best characterized as a phishing kit and service platform for credential and session theft against cloud identity workflows, especially Microsoft 365, with strong emphasis on MFA bypass, anti-analysis, and operational flexibility for affiliates.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.003Spearphishing LinkEvidence1

TTP # T1598.003 — Phishing for Information: Spearphishing Link (Reconnaissance)

Initial Access

5 techniques

T1078Valid AccountsEvidence2

Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts. The BKA said compromised accounts were often used to carry out further crimes.

T1078.004Cloud AccountsEvidence2

MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)

T1566PhishingEvidence7

Top 10 Phishing Kits and Platforms

T1566.001Spearphishing AttachmentEvidence3

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering, QR codes, malicious attachments, and multistage redirects to evade detection.

T1566.002Spearphishing LinkEvidence3

MITRE ATT&CK Mapping Technique ID Technique Applies To T1566.002 Phishing: Spearphishing Link All three kits

Persistence

3 techniques

T1078Valid AccountsEvidence2

T1078.004Cloud AccountsEvidence2

MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)

T1556.006Multi-Factor AuthenticationEvidence1

TTP # T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Credential Access)

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence2

T1078.004Cloud AccountsEvidence2

MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

TTP # T1027 — Obfuscated Files or Information (Defense Evasion)

T1036MasqueradingEvidence2

This technique presents a simulated browser window and address bar inside the phishing page, making the authentication prompt appear to originate from a legitimate Microsoft domain.

T1078Valid AccountsEvidence2

T1078.004Cloud AccountsEvidence2

MITRE ATT&CK Mapping Technique ID Technique Applies To T1078.004 Valid Accounts: Cloud Accounts All three (post-compromise)

T1497Virtualization/Sandbox EvasionEvidence1

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

Defense Impairment

1 technique

T1556.006Multi-Factor AuthenticationEvidence1

TTP # T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Credential Access)

Credential Access

4 techniques

T1539Steal Web Session CookieEvidence7

The platform relayed victims’ credentials and MFA responses to legitimate login services before capturing authenticated session cookies.

T1556.006Multi-Factor AuthenticationEvidence1

TTP # T1556.006 — Modify Authentication Process: Multi-Factor Authentication (Credential Access)

T1557Adversary-in-the-MiddleEvidence9

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

T1621Multi-Factor Authentication Request GenerationEvidence2

MITRE ATT&CK Mapping Technique ID Technique Applies To T1621 Multi-Factor Authentication Request Generation (adjacent real MFA relayed, not generated) Sneaky 2FA, EvilProxy

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.

Collection

2 techniques

T1185Browser Session HijackingEvidence1

Capturing authenticated session material can provide account access even after a victim completes a conventional MFA challenge.

T1557Adversary-in-the-MiddleEvidence9

Tycoon2FA emerged in 2023 as a major AiTM phishing service targeting Microsoft 365, Gmail, and other cloud accounts.

Command and Control

1 technique

T1090ProxyEvidence1

TTP # T1090 — Proxy (Command and Control)

INDICATORS OF COMPROMISE

IOCs tracked for this family

31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

25 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app12 days ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

arctic wolf blogNews

Aug 6, 2026

Payroll Pirates: Strange New Tides in Business Email Compromise - Arctic Wolf

An adversary-in-the-middle phishing kit referenced as another toolkit delivered through similar redirect infrastructure.

the hacker newsNews

Jul 13, 2026

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

A phishing kit/ecosystem referenced as comparable to Forg365 and used in credential theft campaigns involving Microsoft-themed phishing flows and redirection chains.

cyberveilleNews

Jul 3, 2026

Sneaky 2FA : kit de phishing AiTM polymorphe ciblant Microsoft 365 avec replay Entra ID | CyberVeille

Kit de phishing AiTM ciblant les comptes Microsoft. Il implémente un workflow complet de connexion Microsoft pour collecter mot de passe, OTP, code SMS, approbation Authenticator/push MFA, number matching et potentiellement les cookies de session, avec replay quasi temps réel des identifiants vers Microsoft Entra ID. Il inclut aussi des fonctions anti-analyse et de browser-gating.

itproNews

Apr 17, 2026

Tycoon 2FA is down, but not out - researchers warn the phishing as a service operation is still a huge threat to businesses | IT Pro

A newer phishing kit/platform identified as an aggressive newcomer filling the gap left by Tycoon 2FA.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching31

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Sneaky 2FA