Phishing-as-a-Service 'Sneaky 2FA' Kit Enables Browser-in-the-Browser Credential Theft
Threat actors are leveraging a Phishing-as-a-Service (PhaaS) kit called Sneaky 2FA to deploy advanced Browser-in-the-Browser (BitB) phishing attacks. This kit allows attackers to create highly convincing fake browser pop-up windows that closely mimic legitimate sign-in prompts, including a forged address bar displaying authentic-looking URLs. The technique is designed to deceive users into entering their credentials, which are then exfiltrated to the attacker. Security researchers have observed these attacks targeting Microsoft account credentials, with the kit's obfuscated code and anti-analysis features making detection and mitigation more challenging.
The Sneaky 2FA kit is available on criminal marketplaces, enabling even less-skilled threat actors to launch sophisticated phishing campaigns at scale. Attackers often use additional evasion tactics, such as bot protection checks (e.g., Cloudflare Turnstile) and CAPTCHAs, to filter out automated security tools before presenting the fake login window to real users. Experts recommend using password managers, which can help detect these fake forms by refusing to autofill credentials on non-legitimate login pages, as a key defense against such deceptive phishing techniques.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets publicize Sneaky 2FA's new BiTB capability
News outlets including The Hacker News, Malwarebytes, SC Media, BleepingComputer, and CSO Online published reports highlighting the updated Sneaky 2FA kit's use of Browser-in-the-Browser phishing to create convincing fake sign-in windows. The coverage emphasized the growing sophistication and accessibility of phishing-as-a-service tooling.
Push Security details Sneaky 2FA's delivery and evasion tactics
Researchers reported that the attack chain could be triggered from the 'previewdoc[.]us' website, which redirected victims to a subdomain hosting a fake Microsoft login page. They also noted conditional loading, anti-analysis measures, obfuscation, and 'burn-and-replace' URLs designed to improve targeting and evade detection.
Researchers observe updated Sneaky 2FA kit using Browser-in-the-Browser
Security researchers identified a new version of the Sneaky 2FA phishing-as-a-service kit that added Browser-in-the-Browser functionality to mimic legitimate browser login pop-ups and conceal the real phishing URL. The updated kit was observed targeting Microsoft account credentials and MFA codes with fake sign-in windows.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
Sneaky2FA phishing tool adds ability to insert legit-looking URLs
csoonline.com
Open sourceAttackers are using “Sneaky 2FA” to create fake sign-in windows that look real
malwarebytes.com
Open sourceBitB integrated into updated Sneaky 2FA PhaaS kit
scworld.com
Open sourceSneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attack
bleepingcomputer.com
Open sourceSneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar
thehackernews.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophisticated Phishing Campaigns Leveraging Advanced Kits and Evasion Techniques
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026
Bluekit Phishing Kit Uses Browser-in-the-Middle to Steal MFA-Protected Microsoft Sessions
The **Bluekit** phishing-as-a-service platform has expanded quickly and upgraded its credential-theft capability by shifting from adversary-in-the-middle methods to **browser-in-the-middle** attacks aimed at Microsoft logins. Netcraft identified nearly **70 live hostnames** in a week and reported that Bluekit streams an attacker-controlled browser session to victims using the legitimate `rrweb` JavaScript library over WebSockets, letting targets interact with the real Microsoft sign-in page while attackers capture credentials and authenticated session tokens in real time. Researchers said the approach can **bypass MFA** because authentication is completed inside the attacker’s browser, eliminating the browser-fingerprint mismatch often associated with reverse-proxy phishing kits such as Evilginx. Bluekit also includes anti-analysis and victim-filtering features including obfuscated JavaScript, randomized CSS filters, browser fingerprinting, WebRTC-based IP mismatch checks, fake brand-themed CAPTCHA pages, live victim monitoring, AI-assisted phishing email generation, and templates targeting major online services.
Jun 29, 2026
Browser-in-the-Browser Campaign Targets Microsoft 365 OAuth Logins
Palo Alto Networks Unit 42 reported a **Browser-in-the-Browser** phishing campaign targeting Microsoft 365 users with fake OAuth sign-in popups embedded inside malicious webpages. The attackers render the window with HTML, CSS, and JavaScript to mimic a legitimate browser authentication prompt, complete with a spoofed Microsoft URL, padlock icon, draggable behavior, and visual tailoring for Windows, macOS, Linux, Chrome, Firefox, Edge, and Safari. The credential-harvesting flow is delivered through a sandboxed iframe, separating the visible lure from the collection mechanism and making investigation more difficult. Researchers said the campaign uses multiple evasion techniques, including blocking debugging functions, fragmenting keywords and visible strings to bypass filters, and redirecting bots or scanners to a legitimate Microsoft Office help page. Victims who submit credentials can have their Microsoft 365 logins stolen, and attackers may also capture OAuth consent grants or session-like tokens that can preserve access to Microsoft 365 and connected cloud services even after a password reset. Unit 42 published domains linked to the activity and urged defenders to monitor for suspicious active sessions, revoke suspicious tokens, enforce conditional access for managed devices, and adopt phishing-resistant authentication such as **passkeys** or **FIDO2 hardware keys**.
Jun 29, 2026