Push researchers report that PhaaS kits dominate phishing sites targeting their customers, with Sneaky2FA emerging as a notable threat that now incorporates Browser-in-the-Browser (BITB) techniques to harvest Microsoft credentials and sessions. The campaigns rely on bot protection (Cloudflare Turnstile), conditional loading, heavy obfuscation, domain rotation, and embedded reverse-proxy/BITB windows to evade detection and enable account takeover. #Sneaky2FA #BITB
Keypoints
- PhaaS kits account for the vast majority of phishing sites intercepted by Push, with popular kits including Tycoon, NakedPages, Flowerstorm, Salty2FA, Evilginx variations, and others.
- Sneaky2FA usage has increased; it is distributed via a Telegram bot and sold as an obfuscated licensed source-code variant, which enables reliable profiling due to codebase similarities.
- A recent Sneaky2FA campaign combined a Cloudflare Turnstile bot check with a Browser-in-the-Browser (BITB) embedded-browser pop-up that lures users to “Sign in with Microsoft,” resulting in credential and active-session theft.
- Attackers employ multiple detection-evasion techniques: bot protection to thwart crawlers, conditional loading that redirects unwanted visitors to a benign wikibooks page, and anti-analysis checks that detect or disable browser developer tools.
- Sneaky2FA and similar kits use heavy page and code obfuscation plus domain rotation and long randomized URL paths (typically ~150-character paths on benign-looking domains) in a burn-and-replace hosting model to weaken reputation-based defenses.
- Despite these evasions and BITB methods, Push can detect malicious content by inspecting live pages in real time and developing new detections tailored to evolving PhaaS kits and TTPs.
MITRE Techniques
- [T1566 ] Phishing – Use of reverse-proxy/AITM and BITB pages prompting users to “Sign in with Microsoft” to harvest credentials (‘The user is prompted to “Sign in with Microsoft” as part of the phishing lure.’)
- [T1557 ] Adversary-in-the-Middle – Reverse-proxy AITM architecture used to intercept authentication and session tokens (‘reverse-proxy Attacker-in-the-Middle site’)
- [T1078 ] Valid Accounts – Stolen Microsoft credentials and active sessions enabling account takeover (‘Completing authentication will result in the user’s Microsoft credentials and active session being stolen by the attacker, facilitating account takeover.’)
- [T1027 ] Obfuscated Files or Information – Heavy HTML/JavaScript obfuscation and encoded UI elements to evade static detection and fingerprinting (‘The HTML and JavaScript of Sneaky2FA pages are heavily obfuscated to evade static detection and pattern-matching’)
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – Anti-analysis techniques to detect or disable browser developer tools and block page analysis (‘using anti-analysis techniques to detect or disable browser developer tools to block attempts to analyse the page’)
- [T1090 ] Proxy – Use of embedded browser pop-ups/iframes and reverse proxies to mask the real phishing server and display fake login URLs (‘BITB phishing pages replicate the design of a pop-up window with an iframe pointing to a malicious server.’)
- [T1583 ] Acquire Infrastructure – Use of PhaaS kits and for-hire phishing infrastructure (Sneaky2FA, Raccoon0365, etc.) to obtain capabilities and deploy campaigns (‘PhaaS kits make up the vast majority of phishing sites … Raccoon0365 is another PhaaS service’)
Indicators of Compromise
- [Domain ] Initial phishing and hosting domains – previewdoc[.]us (requires Cloudflare Turnstile and redirects to subdomains hosting the phishing page)
- [URL path ] Long randomized phishing paths – previewdoc[.]us/ (campaigns use fresh long randomized paths on benign-looking domains; many are short-lived)
- [Phishing kit name ] Tooling and campaign identifiers – Sneaky2FA, Raccoon0365, and other kits observed (e.g., Tycoon, NakedPages, Flowerstorm, Salty2FA, Evilginx variations)
- [Redirect domain ] Conditional-redirect targets used when checks fail – wikibooks.org (phishing sites redirect to a benign Wikibooks page if conditional loading requirements are not met)
Read more: https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page