Whisper 2FA
Whisper 2FA is a phishing-as-a-service (PhaaS) kit used for rapid deployment of phishing campaigns and multi-factor authentication (MFA) bypass. Reporting cited in the content describes it as a lightweight kit that uses AJAX-based exfiltration to capture credentials and MFA codes in real time, including real-time validation of captured MFA codes. Supported MFA interception methods mentioned in the content include push notifications, SMS, voice calls, and app-based codes. Whisper 2FA has been used in phishing campaigns spoofing major brands including Microsoft 365, Adobe, and DocuSign, and Barracuda reported nearly one million phishing intrusions/attacks associated with the kit since July, making it the third most prevalent PhaaS kit after Tycoon and EvilProxy. The content also states it has benefited from ecosystem shifts following disruption of Tycoon 2FA and is considered an aggressive newer entrant alongside kits such as Sneaky 2FA. Recent versions are described as incorporating dense Base64 and XOR encoding layers, removal of readable text, anti-debugging and anti-analysis features, and behavior that can freeze the browser when developer analysis is detected. The content does not attribute Whisper 2FA to a specific threat actor, but it does indicate it is sold or leased as part of the broader professionalized PhaaS ecosystem.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Credential Access
1 technique
Credential Access
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newer phishing kit/platform identified as an aggressive newcomer after the Tycoon 2FA takedown.
A lightweight phishing kit designed for rapid deployment and multi-method MFA bypass, with strong anti-analysis and obfuscation.
Phishing kit ("since July") designed to facilitate credential theft, with branding implying 2FA-focused lures/bypass.
Whisper 2FA is a sophisticated phishing-as-a-service kit that enables attackers to capture credentials and multi-factor authentication codes in real time. It uses AJAX technology for persistent data capture, integrates multiple encoding and anti-debugging techniques, and is used to spoof brands like Microsoft 365, Adobe, and DocuSign.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.