Our last article exposes the new AiTM phishing kit Sneaky 2FA, sold by the cybercrime service "Sneaky Log"!
We provide an in-depth analysis of the phishing pages, the associated service, detection opportunities and multiple IoCs.
⬇️
https://infosec.exchange/@sekoia_io/113838932313150634
In late December 2024, TRACLabs_
analysed a Sneaky 2FA phishing campaign and dubbed the kit "WikiKit".
Meanwhile, we investigated another campaign that led to the discovery of Sneaky 2FA code, as well as the Telegram bot advertising and selling it.
We confirm that the WikiKit phishing pages correspond to those of the Sneaky Log service, which we chose to name Sneaky 2FA!
Sekoia.io (@[email protected])
🔍 TDR analysts discovered a new Adversary-in-the-Middle (#AiTM) #phishing kit, specifically targeting Microsoft 365 accounts and circumventing 2-step verification: Sneaky 2FA https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/ #detection #sneaky2fa