New Phishing-as-a-Service Kits Bypass MFA to Steal Microsoft 365 Logins

Key Takeaways

• Three sophisticated Phishing-as-a-Service (PhaaS) platforms—Sneaky 2FA, EvilTokens, and EvilProxy—are actively circumventing traditional Multi-Factor Authentication (MFA) to compromise Microsoft 365 accounts.
• These kits employ diverse tactics, including Adversary-in-the-Middle (AiTM) session hijacking and OAuth device code abuse, to steal session tokens or gain direct access without cracking MFA itself.
• US organizations are primary targets, with hundreds of businesses already compromised across various sectors.
• Traditional MFA methods (TOTP, SMS, push notifications) are often bypassed; phishing-resistant MFA like FIDO2/WebAuthn is recommended for robust protection.

Advanced Phishing Kits Evolve to Bypass MFA, Threatening Microsoft 365 Users

A new wave of Phishing-as-a-Service (PhaaS) platforms, identified as Sneaky 2FA, EvilTokens, and EvilProxy, is actively targeting organizations, particularly in the United States, to steal Microsoft 365 (M365) credentials and session tokens. These sophisticated kits represent a significant escalation in the threat landscape, as they are specifically designed to bypass standard multi-factor authentication (MFA) protections, rendering traditional security advice, such as “enable MFA,” insufficient on its own.

While each platform utilizes a distinct technical approach—ranging from Adversary-in-the-Middle (AiTM) session hijacking to OAuth device-code abuse and real-time reverse-proxy credential relay—their ultimate goal is identical: to obtain a fully authenticated M365 session or token without ever directly compromising the MFA mechanism. Instead, victims are tricked into completing legitimate MFA challenges, with the attacker silently capturing the resulting session artifacts.

This report will delve into the infrastructure, attack chains, detection opportunities, and MITRE ATT&CK mappings for each of these kits, providing critical data for defensive tooling.

Why MFA Alone No Longer Stops These Attacks

The fundamental flaw exploited by all three PhaaS kits lies in how MFA validates a login event versus where the resulting authentication token or cookie ultimately resides. Sneaky 2FA and EvilProxy act as live man-in-the-middle proxies, intercepting the legitimate authentication flow between the victim and Microsoft. They relay the real authentication process, skimming the session cookie or token the instant it is issued by Microsoft’s servers.

EvilTokens takes a different route, completely avoiding credential or cookie theft. It abuses the OAuth 2.0 Device Authorization Grant, a legitimate Microsoft feature designed for keyboardless devices like smart TVs. The victim is manipulated into directly authorizing the attacker’s client on Microsoft’s infrastructure, granting the attacker valid access and refresh tokens.

Kit 1: Sneaky 2FA AiTM Session Cookie Theft

Sneaky 2FA is an Adversary-in-the-Middle (AiTM) phishing kit initially detected by Sekoia’s Threat Detection & Research team in December 2024, although its campaigns date back to October 2024. This kit is distributed as a licensed, obfuscated PhaaS product via an automated Telegram bot, @SneakyLog_bot, operated by a cybercrime service known as “Sneaky Log.” This service also offers a bulk email sender and various redirect/attachment tools. Analysis of its leaked source code revealed shared components with the W3LL OV6 AiTM kit, previously reported by Group-IB in 2023, including identical User-Agent handling and cookie-parsing functions.

Attack Chain

A key evasion tactic employed by Sneaky 2FA is a Cloudflare Turnstile (or reCAPTCHA) challenge gate positioned before the fake login page. This mechanism effectively blocks automated scanners and sandboxes, as bots typically fail or bypass CAPTCHA challenges. Victims who successfully pass this human verification are presented with a pixel-perfect clone of a Microsoft authentication page, often featuring blurred screenshots of legitimate M365 interfaces (such as Outlook, OneDrive, or SharePoint) as visual lures.

1. The victim clicks a phishing link or QR code, frequently embedded in a PDF document titled deceptively (e.g., “Final Lien Waiver.pdf”).
2. Traffic undergoes an open-redirect step before landing on a Cloudflare Turnstile gate, initially disguised as a benign page like “Gourmet Delights.”
3. IP-based filtering silently redirects known data-center, VPN, proxy, or abuse IPs to a Microsoft-related Wikipedia page via href.li.
4. Legitimate victims are shown the fake M365 login page, with their email address often pre-filled from the URL parameter (autograb).
5. Credentials entered are POSTed to the /validate endpoint; the phishing server then relays these live to Microsoft’s authentication API.
6. The victim completes legitimate MFA (e.g., Authenticator push, OTP, or SMS) directly against Microsoft’s backend.
7. The resulting session cookie is captured server-side by the attacker for subsequent account takeover.

High-Fidelity Detection: “Impossible Device Shift”

Sekoia researchers discovered a unique detection opportunity: Sneaky 2FA hardcodes different User-Agent strings for each stage of the authentication flow it relays to Microsoft. For instance, a Safari-on-iOS User-Agent might be used for the initial login, followed by a Chrome-on-Windows User-Agent for MFA resolution within the same session. This “impossible device shift” is an anomaly that no genuine user’s browser would produce. It can be detected using Sigma correlation rules against Entra ID/M365 audit logs, by correlating Login:login and Login:resume events based on correlation ID within a 10-minute timeframe.

Sneaky 2FA IOCs

Sekoia has made a comprehensive set of roughly 61 indicators, including 57 domains, two IPs, and two subdomains, publicly available in CSV format via the SEKOIA-IO Community GitHub repository. Additional confirmed attacker-controlled domains include africanagrirnarket[.]com, allorganicitems[.]com, emailsay[.]com, files42[.]com, flonrenceorganics[.]us, guardiansresearch[.]org, intertrustsgroup[.]com, omnirayoprah[.]cfd, portalpowerfiles[.]top, reliant-rehabs[.]com, storageorder[.]sbs, and windstreaim[.]com. Independent DNS analysis indicates an average dwell time of 113 days between domain registration and threat intelligence detection for Sneaky 2FA infrastructure, with approximately one-third of these indicators remaining undetected for over 90 days.

Kit 2: EvilTokens OAuth Device Code Token Theft

EvilTokens, a PhaaS platform that emerged in mid-February 2026, has already compromised more than 340 Microsoft 365 organizations across at least seven countries. This kit deviates significantly from traditional phishing by never presenting a fake login page or directly capturing passwords. Instead, EvilTokens weaponizes Microsoft’s legitimate OAuth 2.0 Device Authorization Grant, a flow designed for keyboardless devices to authenticate using a short code entered at microsoft.com/devicelogin.

Attack Chain

The attacker’s client initiates a device authorization request with Microsoft’s API, obtaining a genuine and valid device code and user code, indistinguishable from a legitimate Smart TV or printer authentication request. The victim then receives a deceptive lure, often disguised as a meeting invitation, Adobe Sign, or DocuSign request, instructing them to enter this code at the authentic Microsoft URL. Once the victim authenticates—including completing their real MFA challenge as expected—Microsoft’s backend issues valid access and refresh tokens directly to the attacker’s polling client, bypassing the victim’s device entirely.

1. The attacker requests a device code/user code from Microsoft’s OAuth endpoint, often after validating the target’s account existence via the GetCredentialType endpoint on login.microsoftonline.com.
2. The victim receives a lure containing a verification code and a “Sign in” button linked to the legitimate Microsoft device-login page.
3. The victim manually enters the code and completes the normal sign-in process, including TOTP, SMS, or push-based MFA.
4. Microsoft’s authorization server issues access and refresh tokens directly to the attacker’s pre-polling client.
5. The attacker gains ongoing, silent API access to the victim’s Exchange, OneDrive, SharePoint, Teams, and calendar data, without triggering any phishing page, malicious login, or MFA alert.

The Register described this toolkit as a “complete business email compromise operations environment,” with Talos researchers noting its subsequent use for business email compromise fraud, beyond just initial access. Both Push Security and Sekoia have observed a sharp increase in device-code phishing adoption throughout 2026, identifying shared backend IPs on the Railway cloud platform used for token replay.

EvilTokens IOCs

Kit 3: EvilProxy Reverse-Proxy AiTM at Scale

EvilProxy, operational since May 2022, stands as one of the longest-running commercial AiTM PhaaS platforms. It is widely marketed on dark-web forums, offering turnkey targeting for major identity providers such as Microsoft 365, Google Workspace, Dropbox, and GitHub. In August 2023, Proofpoint and Menlo Security tracked a significant campaign that leveraged EvilProxy to compromise M365 accounts of C-level executives and managers across more than 100 organizations globally.

Attack Chain

EvilProxy functions as a genuine reverse proxy, routing victim traffic through attacker-controlled infrastructure that fetches and displays the actual Microsoft login page content in real-time. This real-time mirroring means the phishing page’s source code closely resembles the legitimate site, making it challenging for automated scanners and visual inspection to flag it as malicious. Prior to serving any content, the kit employs extensive virtual machine detection and browser fingerprinting to filter out security researchers and sandboxes.

1. The victim receives a phishing email, often with a fake voicemail, DocuSign, or document-sharing lure, leading to an open-redirect chain.
2. Traffic lands on an EvilProxy phishing framework that mimics the target organization’s actual branding.
3. Credentials entered by the victim are passed through to the legitimate Microsoft or Google backend in real time.
4. If MFA is enabled, the real MFA prompt is proxied back to the victim, who completes it normally against the legitimate identity provider.
5. The reverse proxy harvests the resulting session cookie mid-transit, granting the attacker live, authenticated access without requiring the password or MFA code again.

Okta’s Threat Intelligence team confirmed an EvilProxy campaign active since at least March 2025, describing it as evolving and formally identifying it as threat actor O-TA-041. Barracuda researchers highlighted key detection indicators: unusual MFA prompts appearing when the user is not actively logging in, and login page URLs that do not match the organization’s usual authentication domain.

EvilProxy IOCs

MITRE ATT&CK Mapping

What You Should Do

The emergence of these sophisticated PhaaS kits necessitates a re-evaluation of current cybersecurity defenses. Phishing-resistant MFA is the only control that fundamentally defeats all three kits, as TOTP, SMS, and standard push-based MFA can be relayed or redirected. FIDO2/WebAuthn passkeys and hardware certificate-based authentication, however, cannot be proxied or device-code-hijacked in the same manner. Organizations should also consider restricting the OAuth Device Authorization Grant flow for most corporate users via Conditional Access policies in Microsoft Entra ID, given that typical employees rarely require keyboardless-device sign-in.

• Block or tightly scope the Device Code authentication flow in Entra ID Conditional Access for users who do not operate keyboardless/IoT devices.
• Deploy Sigma/KQL correlation rules to detect “impossible device shift,” looking for inconsistent User-Agent strings across the same authentication correlation ID within a short time window.
• Monitor Entra ID Identity Protection alerts for “Impossible Travel,” “Anonymized IP Sign-in,” and “Anomalous Token Detected,” which flag geographically inconsistent or unusual token issuance patterns.
• Flag sign-ins originating from data-center/hosting-provider IP ranges (e.g., DigitalOcean, Railway, Cloudzy, PacketHub, OVH, Hetzner) known to be associated with EvilTokens and Sneaky 2FA backend infrastructure.
• Educate users to never enter a Microsoft device-login verification code unless they have personally initiated a device sign-in request.
• Inspect phishing URLs for the distinctive 150-character alphanumeric path pattern followed by /index, /verify, or /validate, a high-fidelity signature for Sneaky 2FA.
• Treat unexpected MFA prompts (those arriving when the user is not actively logging in) and login-domain mismatches as high-priority indicators of potential EvilProxy activity.
• Enforce short session-token lifetimes and implement Continuous Access Evaluation (CAE) in Entra ID to reduce the ongoing value of a stolen cookie or OAuth token.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.