sneaky2fa

Also known assneaky2fa

Sneaky2FA is a phishing-as-a-service (PhaaS) kit used to facilitate credential and multi-factor authentication (MFA) theft. Reported capabilities include browser-in-the-browser (BITB) functionality that enables operators to create fake browser windows with customizable address bars to mimic legitimate login prompts. The kit can capture credentials and MFA codes in real time via reverse-proxy and iframe-based phishing workflows. Sneaky2FA operates through a full-featured bot on Telegram, and customers receive a licensed, obfuscated version of the source code for independent deployment. Observed tradecraft includes anti-analysis measures to detect or disable browser developer tools, heavily obfuscated HTML and JavaScript, UI text broken up with invisible tags, interface elements embedded as encoded images, and 'burn-and-replace' randomized URLs that activate only during attacks to evade reputation-based defenses. The content also notes that BITB delivery is spreading beyond email to channels such as LinkedIn Messenger and Google Search. No nation-state attribution is provided in the source content. Known alias: sneaky2fa.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

7 of 15 tactics12 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

2 techniques

T1078

Valid Accounts

T1566

Phishing

TA0003

Persistence

1 technique

T1078

Valid Accounts

TA0004

Privilege Escalation

1 technique

T1078

Valid Accounts

TA0005

Stealth

2 techniques

T1036

Masquerading

T1078

Valid Accounts

TA0006

Credential Access

2 techniques

T1539

Steal Web Session Cookie

T1557

Adversary-in-the-Middle

TA0008

Lateral Movement

1 technique

T1534

Internal Spearphishing

TA0009

Collection

2 techniques

T1114

Email Collection

T1114.003

Email Forwarding Rule

T1557

Adversary-in-the-Middle

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cso onlineNews

Nov 20, 2025

Sneaky2FA phishing tool adds ability to insert legit-looking URLs

Sneaky2FA is a phishing-as-a-service kit that enables threat actors to bypass multi-factor authentication (MFA) by using advanced browser-in-the-browser (BITB) phishing techniques. It provides customizable, obfuscated phishing pages that capture credentials and MFA codes, allowing attackers to hijack live sessions and access enterprise cloud accounts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping7

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.