Sneaky 2FA phishing kit
Sneaky 2FA is an adversary-in-the-middle Microsoft 365 phishing kit. We have matched it on 20 sites since 1 August.
Sneaky 2FA in numbers
Since 1 August, the first Sneaky 2FA match in our records, counted on 12 October 2026. How we count.
| Sites with Sneaky 2FA code | 20 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| New sites in September | 1 |
| Last match | 5 September |
Sneaky 2FA arrives through hosted login pages
Sekoia named Sneaky 2FA after finding references to the Sneaky Log service in its code and infrastructure. Its research traces the kit to October 2024 and describes copies deployed on compromised websites, including WordPress sites, as well as domains controlled by customers of the service.
The first page can be a shared-document or enterprise login prompt that asks for an email address. Some copies then place a browser check in front of the Microsoft-styled portal. The portal collects the password and presents the verification method returned for that account: an Authenticator approval, a verification code or an SMS code. It keeps polling while an Authenticator request is pending.
The gate measures the visitor before opening the portal
Our September capture shows a fake visitor check that reads an email hint from the URL, sends it to a same-origin endpoint and removes it from the address bar. It records up to 200 mouse or touch points with timing, rejects common browser-automation signals and creates a canvas fingerprint.
After the visitor clicks, the server returns a nonce, target and round count. The page combines the nonce with a hash of the interaction trace, creates several Web Workers and gives them 12 seconds to find an acceptable SHA-256 result. The worker code is XOR-encoded in this copy. Each worker tests a different sequence of counters, and the first valid result is posted back for a redirect token.
Other gates keep the same separation between gate and portal while changing the test. One uses readable worker code behind a slider. Another serves a Base64-encoded image puzzle with a numeric answer and an off-screen sys_ honeypot field. These are distinct builds of the same screening layer.
What we see
| Month | New sites |
|---|---|
| September | 1 |
| October so far | 0 |
The latest Sneaky 2FA match in this snapshot was 5 September. The last 30 days contain 0 matches.
Checking a site for Sneaky 2FA
Record workers and same-origin requests while opening the exact path with safe test data. Look for:
- a gate that records pointer coordinates, timing and a canvas fingerprint
- a challenge response containing a nonce, target and round count
- several Web Workers performing repeated SHA-256 operations
- XOR-decoded worker source or an off-screen
sys_field beside an image puzzle - one Microsoft-styled page with password, code, SMS and Authenticator actions
- repeated polling while the page waits for Authenticator approval
Remove the gate, portal and their server routes. Review the CMS, hosting and deployment accounts with write access to the files, then rotate their credentials.