Threats Tagged '2fa bypass'

Mirage2FA is a phishing-as-a-service toolkit that hijacks Microsoft 365 sessions by stealing credentials and authenticated sessions via Adversary-in-the-Middle attacks. It targets corporate users primarily in the US, affecting industries such as Technology, Manufacturing, and Education. The toolkit uses browser-based delivery methods including HTML smuggling, QR codes, JavaScript obfuscation, and WebSocket communication to bypass two-factor authentication. Between 2024 and 2026, it compromised over 4,500 Microsoft 365 accounts out of approximately 9,400 targeted email addresses, enabling attackers to access corporate email, sensitive data, and trusted business accounts.

MediumCampaignUnited StatesBritish Indian Ocean TerritoryCanada+4#microsoft 365#websocket#adversary-in-the-middle

The UNC1151/Ghostwriter group is conducting high-intensity phishing campaigns targeting Gmail accounts of Polish citizens since March 2026. The campaigns primarily target individuals in political and public life, prominent positions, researchers, journalists, public administration and law enforcement employees, and their associates. Attackers use fraudulent emails impersonating Gmail administrators, claiming suspicious activity or policy violations to pressure victims into verifying their accounts. The phishing infrastructure captures login credentials and two-factor authentication codes through fake login panels. The group utilizes dedicated domains, Netlify subdomains, and compromised websites to host phishing pages. Campaigns run primarily on weekdays with new domains appearing almost daily, demonstrating persistent operational tempo against Polish targets.

MediumPhishingPoland#unc1151#gmail#phishing

A new Phishing-as-a-Service (PhaaS) framework dubbed Salty 2FA has been discovered targeting industries in the US and EU. It uses a unique domain pattern combining .com subdomains with .ru domains and employs a multi-stage execution chain to resist detection. The kit can bypass multiple 2FA methods, including push, SMS, and voice. Victims span global industries such as finance, telecom, energy, consulting, logistics, and education. Static IOCs are unreliable for detection; instead, behavioral patterns must be identified. The framework shares traits with Storm-1575 but has distinct characteristics setting it apart from known threats like Tycoon2FA or EvilProxy. It demonstrates sophisticated capabilities in distributing phishing payloads, maintaining dynamic infrastructure, and managing complex communication between phishing pages and C2 servers.

MediumMalwareFranceGermanyGreece+2#salty 2fa#storm-1575#domain pattern