Sneaky2FA
Sneaky2FA is a phishing kit observed by Any.Run researchers being hosted on trusted cloud/CDN infrastructure to evade domain- and reputation-based detections. It has been found hosted on Firebase Cloud Storage (firebasestorage[.]googleapis[.]com) and also on AWS CloudFront (cloudfront[.]net). The kit presents fake Microsoft 365 login pages and is used to harvest corporate (enterprise) account credentials; campaigns may filter out free email accounts to focus on corporate users. The described detection challenge is that the underlying hosting domains are legitimate and widely trusted, with the maliciousness residing in the served content and user interaction flow rather than the cloud infrastructure itself. No specific threat actor attribution is provided in the content. Example related indicators of compromise listed in the content include mphdvh[.]icu, kamitore[.]com, aircosspascual[.]com, and Lustefea[.]my[.]id.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Credential Access
1 technique
Credential Access
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An AiTM phishing kit offered as a Phishing-as-a-Service toolset, used to capture enterprise credentials and session tokens (including in MFA-protected flows) by acting as a proxy between the victim and legitimate login services.
An AiTM phishing kit offered as a Phishing-as-a-Service platform, used to steal enterprise credentials and session tokens by acting as a proxy between victims and legitimate login services, allowing MFA bypass.
A phishing kit family leveraging Firebase Cloud Storage and AWS CloudFront to host fake Microsoft 365 login pages for harvesting enterprise credentials (with an emphasis on corporate accounts).
Sneaky2FA is a phishing kit designed to bypass two-factor authentication, now enhanced with Browser-in-the-Browser (BITB) techniques for more convincing phishing attacks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.