Three distinct Phishing-as-a-Service (PhaaS) platforms, Sneaky 2FA, EvilTokens, and EvilProxy, are actively targeting US organizations to steal Microsoft 365 credentials and session tokens, effectively neutralizing standard multi-factor authentication (MFA) protections. Each kit uses a fundamentally different technical approach: Adversary-in-the-Middle (AiTM) session hijacking, OAuth device-code abuse, and real-time reverse-proxy credential relay, but all three converge on the same outcome: a fully authenticated M365 session or token in the attacker’s hands without ever “cracking” MFA itself. For defenders, this represents a critical shift in the threat landscape, as traditional advice to “enable MFA” is no longer sufficient on its own, because these kits are purpose-built to make the victim complete real, legitimate MFA challenges while the attacker silently captures the resulting session artifact.
Sneaky 2FA and EvilProxy sit as a live man-in-the-middle proxy between victim and Microsoft, relaying the real authentication flow and skimming the session cookie the moment it is issued. EvilTokens goes a step further and doesn’t touch credentials or cookies at all; it abuses the OAuth 2.0 Device Authorization Grant, tricking the victim into authorizing the attacker’s client directly on Microsoft’s own infrastructure.[/subscribe_to_unlock_form]
Three distinct Phishing-as-a-Service (PhaaS) platforms, Sneaky 2FA, EvilTokens, and EvilProxy, are actively targeting US organizations to steal Microsoft 365 credentials and session tokens, effectively neutralizing standard multi-factor authentication (MFA) protections. Each kit uses a fundamentally different technical approach: Adversary-in-the-Middle (AiTM) session hijacking, OAuth device-code abuse, and real-time reverse-proxy credential relay, but all three converge on the same outcome: a fully authenticated M365 session or token in the attacker’s hands without ever “cracking” MFA itself. For defenders, this represents a critical shift in the threat landscape, as traditional advice to “enable MFA” is no longer sufficient on its own, because these kits are purpose-built to make the victim complete real, legitimate MFA challenges while the attacker silently captures the resulting session artifact.
Sneaky 2FA and EvilProxy sit as a live man-in-the-middle proxy between victim and Microsoft, relaying the real authentication flow and skimming the session cookie the moment it is issued. EvilTokens goes a step further and doesn’t touch credentials or cookies at all; it abuses the OAuth 2.0 Device Authorization Grant, tricking the victim into authorizing the attacker’s client directly on Microsoft’s own infrastructure.[emaillocker id="1283"]
The kits employ various evasion techniques, including Cloudflare Turnstile/reCAPTCHA challenges, IP/data-center filtering, multi-redirect chains via trusted sites, and AI-generated lure infrastructure. This attack represents a critical shift in the threat landscape, as traditional advice to “enable MFA” is no longer sufficient on its own. Organizations should restrict the OAuth Device Authorization Grant flow entirely for standard corporate users via Conditional Access policies in Microsoft Entra ID, and deploy Sigma/KQL correlation rules for ‘impossible device shift’ inconsistent User-Agent strings across the same authentication correlation ID within a short time window.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1566.002 | Phishing | Spearphishing Link |
| Defence Evasion | T1036.005 | Masquerading | Match Legitimate Resource Name or Location |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
The following reports contain further technical details:
[/emaillocker]