👾 #Mamba2FA #phishing kit lets attackers bypass MFA and access victims’ Microsoft 365 accounts.
Used against individuals and businesses, it is gaining popularity, with campaigns seen in Europe, North America, and parts of Asia.
🎯 See analysis: https://any.run/malware-trends/mamba/?utm_source=mastodon&utm_medium=post&utm_campaign=mamba&utm_content=tracker&utm_term=140725
Here's part 1 of 2 describing how PhaaS use anti-bot services to help filter out security services and analysts. This part covers how #Mamba2FA uses #Adspect.
https://rmceoin.github.io/malware-analysis/2024/12/21/antibot1.html
Phishing-as-a-Service (PhaaS) kits will frequently employ one or more techniques to avoid detection by security software. Often they will use a captcha like Cloudflare Turnstile, Google reCAPTCHA, or even their own captcha. Another one of the methods used is to leverage another service called an anti-bot service. These paid services offload the work required to differenciate between potential victims and malware security scanning. The PhaaS operator may advertise their anti-bot capabilities as part of their services, which is actually their use of these separate services.
Phishing-as-a-Service (PhaaS) kits will frequently employ one or more techniques to avoid detection by security software. Often they will use a captcha like Cloudflare Turnstile, Google reCAPTCHA, or even their own captcha. Another one of the methods used is to leverage another service called an anti-bot service. These paid services offload the work required to differenciate between potential victims and malware security scanning. The PhaaS operator may advertise their anti-bot capabilities as part of their services, which is actually their use of these separate services.
🔎 Tracking down #phishing threats can be a challenge
That's why we asked expert researcher Jane_0sint to share her tricks of the trade with us
See her use cases for investigating #Mamba2FA, APT-C-36, and other threats ⬇️
https://any.run/cybersecurity-blog/investigating-phishing-threats?utm_source=mastodon&utm_medium=post&utm_campaign=investigating_phish&utm_content=linktoblog&utm_term=261124
ANY.RUN
The Threat Codex
gregclermont
Randy
Sekoia.io