Three PhaaS Kits Bypass MFA by Hijacking Microsoft 365 Sessions
New Phishing-as-a-Service kits are targeting US organizations, stealing Microsoft 365 credentials and session tokens by tricking users into completing legitimate MFA challenges.
Three sophisticated Phishing-as-a-Service (PhaaS) platforms—Sneaky 2FA, EvilTokens, and EvilProxy—are actively targeting organizations in the United States, aiming to steal Microsoft 365 (M365) credentials and authenticated session tokens. These kits represent a significant evolution in phishing tactics, as they bypass traditional multi-factor authentication (MFA) not by breaking it, but by making the victim complete legitimate MFA challenges while the attacker captures the resulting session artifacts. This renders the common advice to "enable MFA" insufficient on its own, as these tools are specifically designed to circumvent its protections.
Each of these kits employs a distinct technical approach to achieve the same goal: gaining unauthorized access to M365 accounts. Sneaky 2FA and EvilProxy utilize Adversary-in-the-Middle (AiTM) techniques, acting as a proxy between the victim and Microsoft's authentication servers. They relay the login process in real-time, capturing session cookies once a legitimate MFA prompt is successfully answered by the victim. EvilTokens, on the other hand, exploits the OAuth 2.0 Device Authorization Grant flow, a feature designed for keyboardless devices, to trick users into authorizing the attacker's application directly, thereby obtaining session tokens without ever handling credentials or cookies.
The Sneaky 2FA kit, identified by Sekoia in late 2024, is sold via a Telegram bot and reuses components from older AiTM kits. Its attack chain involves a Cloudflare Turnstile or reCAPTCHA challenge to deter bots, followed by a near-perfect clone of the Microsoft login page. Victims are lured through phishing emails, often with deceptive PDF attachments. After passing the CAPTCHA and potential IP-based filtering, users are presented with the fake login. The kit relays credentials to Microsoft's API and, crucially, captures the session cookie after the victim completes a real MFA prompt. A key detection indicator for Sneaky 2FA is an "impossible device shift" in M365 audit logs, where the User-Agent string changes mid-session in a way no legitimate user's browser would.
EvilTokens leverages the OAuth 2.0 Device Authorization Grant, a legitimate Microsoft feature for authorizing applications on devices without direct browser access. Attackers present victims with a code to enter on a specific Microsoft URL. The victim then logs in and completes MFA on Microsoft's legitimate site, authorizing the attacker's application. The attacker receives session tokens directly, bypassing the need to intercept cookies or credentials from a phishing page. This method is particularly insidious as it relies on a trusted Microsoft workflow, making it harder to detect.
EvilProxy, observed since mid-2022, operates as a reverse-proxy AiTM kit. It mimics real login pages and intercepts credentials and session cookies in real-time as they are exchanged between the victim and Microsoft. The kit employs VM and browser fingerprinting techniques, along with random URLs, to evade detection. Its sophistication lies in its ability to create near-identical clones of legitimate login pages, making it highly convincing to unsuspecting users.
The impact of these PhaaS kits is significant, particularly for US organizations. Sneaky 2FA has been linked to over 100 domains and 61 indicators of compromise. EvilTokens has compromised over 340 M365 organizations across seven countries since February 2026. EvilProxy has targeted over 100 organizations, focusing on executives and managers. The common thread is the exploitation of trust and the manipulation of legitimate authentication flows to achieve account takeover, highlighting a critical gap in current MFA strategies.
Defenders must adapt their strategies beyond simply enabling MFA. Monitoring for "impossible device shifts" in authentication logs, scrutinizing OAuth authorization requests, and implementing advanced threat detection for AiTM activities are crucial. The rise of these PhaaS kits underscores the need for continuous vigilance and layered security approaches to protect cloud-based identities and data.
The Greatness PhaaS platform represents a significant evolution in phishing-as-a-service, specifically targeting Microsoft 365 accounts by employing sophisticated techniques to bypass email security and multi-factor authentication. Unlike previous iterations that might have focused solely on credential harvesting, Greatness is capable of capturing valid session tokens through real-time login relays and device-code phishing, allowing attackers to maintain access even after MFA prompts. This new campaign leverages spoofed messages from trusted brands like RingCentral, exploiting domain-based safe-sender exclusions to bypass SPF, DKIM, and DMARC checks, turning a convenience feature into a critical vulnerability.