Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service
Essential information
- Published
- 17/01/2025 17:01
- Modified
- 17/01/2025 17:54
- Tags
- 2025-01-17 aitm cryptocurrency obfuscation phishing telegram
- Related entities
- 26 observables, 1 intrusion sets (apt), 7 techniques (mitre), 1 malware
Description
A new Adversary-in-the-Middle (AiTM) phishing kit called Sneaky 2FA has been discovered targeting Microsoft 365 accounts. The kit is sold as Phishing-as-a-Service by a cybercrime service called Sneaky Log, which operates via a Telegram bot. Sneaky 2FA uses anti-bot and anti-analysis features, authenticates with Microsoft APIs, and employs various obfuscation techniques. The phishing pages are typically hosted on compromised WordPress sites or attacker-controlled domains. The kit appears to be based on the W3LL OV6 phishing kit codebase. Sneaky Log's operations include selling tools like the AiTM phishing kit, an email sender, and redirect/attachment services. The service uses multiple cryptocurrencies for payments and may employ transaction obfuscation mechanisms.