Three distinct Phishing-as-a-Service (PhaaS) platforms are targeting US organizations, aiming to compromise Microsoft 365 credentials by circumventing Multi-Factor Authentication (MFA). The platforms—Sneaky 2FA, EvilTokens, and EvilProxy—exploit MFA vulnerabilities, posing significant security threats.
Innovative Attack Techniques
Each PhaaS platform uses unique methods to bypass MFA. Sneaky 2FA employs Adversary-in-the-Middle (AiTM) session hijacking, EvilTokens exploits OAuth device-code authorization, and EvilProxy utilizes real-time reverse-proxy credential relays. Despite different tactics, all aim to deliver authenticated Microsoft 365 sessions to attackers.
The platforms enable attackers to capture session tokens without breaking MFA protocols, undermining traditional security measures like enabling MFA. Users complete legitimate MFA challenges, unaware that session tokens are being intercepted.
Sneaky 2FA: Session Cookie Theft
Identified by Sekoia in late 2024, Sneaky 2FA is an AiTM phishing kit that mimics Microsoft authentication pages to capture session cookies. Its infrastructure includes CAPTCHA challenges to evade automated detection and employs IP filtering to redirect non-target traffic.
Sneaky 2FA’s attack chain involves victims completing MFA on genuine Microsoft servers, with session cookies intercepted by attackers for unauthorized account access. Detection relies on identifying inconsistent User-Agent strings during authentication.
EvilTokens and EvilProxy: Advanced Exploits
EvilTokens, emerging in February 2026, manipulates Microsoft’s OAuth 2.0 Device Authorization flow to acquire tokens. Victims authorize attackers via genuine Microsoft pages, leading to unauthorized API access without raising alerts.
EvilProxy, operational since May 2022, acts as a reverse proxy, capturing credentials and session tokens during legitimate login processes. It evades detection through sophisticated infrastructure mimicking genuine login interfaces.
Defense Strategies and Future Outlook
To combat these threats, organizations must adopt phishing-resistant MFA solutions like FIDO2/WebAuthn to prevent token interception. Restricting OAuth Device Authorization flows and implementing robust detection measures, such as monitoring unusual MFA prompts and URL patterns, are crucial.
As PhaaS platforms evolve, continuous vigilance and proactive defense strategies are essential to safeguard against these sophisticated phishing attacks, ensuring the integrity of organizational cybersecurity frameworks.
