Threat reportThreat IntelligenceTL-2026-1888
Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials and Session Tokens
Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) (TL-2026-1888), also tracked as Sneaky 2FA campaign, is a high-severity tracked intrusion set, first published 2026-08-05. It is attributed to Sneaky Log with low confidence, affects Microsoft Microsoft 365 / Entra ID, maps to 16 MITRE ATT&CK techniques (T1027, T1056, T1078), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1Sneaky Log
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-1888
- Threat ID
- TL-2026-1888
- Also known as
- Sneaky 2FA campaign, EvilTokens campaign, EvilProxy O-UNC-035 campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Sneaky Log
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, health, technology, manufacturing, retail, aviation, insurance, pharmacy, logistics
- Target regions
- North America, Europe, australia, Middle East, Asia, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 27
How Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) works
Three distinct Phishing-as-a-Service (PhaaS) kits — Sneaky 2FA (AiTM reverse-relay, ~$200/mo, 100+ domains since Oct 2024), EvilTokens (OAuth Device Code abuse, 340+ M365 orgs across 7+ countries since Feb 2026), and EvilProxy (reverse-proxy AiTM, 100+ orgs globally since May 2022, tracked by Okta as O-TA-041) — actively target US organizations for M365 credential theft, session cookie hijacking, and downstream BEC operations. All three functionally bypass MFA by exploiting the structural gap between authentication validation and token/cookie provenance.
Three commercially available Phishing-as-a-Service (PhaaS) kits are actively targeting US organizations to compromise Microsoft 365 accounts by bypassing multi-factor authentication through fundamentally different technical approaches. Together they represent a structured escalation in the phishing-as-a-service ecosystem, each refining a distinct MFA-bypass technique into a turnkey product.
Sneaky 2FA (operated by 'Sneaky Log' via @SneakyLog_bot on Telegram, ~$200/month) employs an Adversary-in-the-Middle reverse-relay architecture. The victim clicks a phishing link or scans a QR code from a PDF attachment, passes through a Cloudflare Turnstile gate and IP-filtering layer, and lands on a cloned M365 login page. Credentials are POSTed to the phishing server, which relays them live to Microsoft's API. The victim completes real MFA against Microsoft's backend, and the session cookie is captured server-side. The kit rotates User-Agent strings across authentication steps (e.g., Safari-on-iOS for login, Chrome-on-Windows for MFA), enabling the 'impossible device shift' detection signature. First observed in October 2024 and formally disclosed by Sekoia in December 2024, the kit reuses source code from the W3LL OV6 AiTM kit (Group-IB, 2023). By early January 2025, over 100 Sneaky 2FA domains had been identified. In 2025, the kit added Browser-in-the-Browser (BITB) functionality per CSO Online reporting, and has been observed using trusted sender abuse, route polymorphism, and M365 replay attacks per ZeroBEC research. The operator infrastructure includes license-validation servers at sneakylog[.]store and 185.125.100[.]81, with cryptocurrency payments (BTC, USDT-TRC20, ETH, LTC) laundered through a third-party mixing service.
EvilTokens (first observed mid-February 2026, disclosed by Sekoia in March 2026) pioneers a fundamentally different approach: it never presents a fake login page or captures a password. Instead it weaponizes the OAuth 2.0 Device Authorization Grant flow — designed for keyboardless devices — against Microsoft 365. The attacker requests a device code from Microsoft's legitimate OAuth endpoint, then tricks the victim into entering the code at microsoft.com/devicelogin. The victim completes normal sign-in including MFA, and Microsoft issues access and refresh tokens directly to the attacker's already-polling client. The kit features dynamic code generation (the 15-minute timer starts only when the victim lands on the page), AI-generated hyper-personalized lures, and a backend API that converts refresh tokens to Primary Refresh Tokens (PRTs) for persistent access. The infrastructure spans thousands of Railway.com polling nodes, Cloudflare Workers, Vercel, and AWS Lambda, with the X-Antibot-Token custom HTTP header used for backend authentication. Over 340 M365 organizations across 7+ countries have been compromised since mid-February 2026. Post-compromise capabilities include 7 parallel Graph API reconnaissance queries, Azure resource enumeration, OWA session cookie generation, and automated inbox rule creation for BEC fraud. The kit is assessed by Sekoia as 'the first PhaaS to offer turnkey Microsoft device code phishing pages' and Microsoft's Defender Security Research confirmed the campaign as an escalation of the prior Storm-2372 device code phishing campaign from February 2025.
EvilProxy (tracked as O-TA-041 by Okta Threat Intelligence, operating since May 2022) is one of the longest-running commercial AiTM PhaaS platforms. It uses a reverse-proxy architecture that sits between the victim and the legitimate identity provider, proxying the entire authentication flow in real time including MFA challenges. The victim sees a convincing Microsoft-branded page with the target organization's name dynamically populated; the proxy captures both credentials and session cookies in transit. The kit features extensive anti-analysis: VM and browser fingerprinting, IP blocklisting via api.ipify.org, domain blocklisting, and bot detection that redirects scanners to the legitimate Microsoft login page. A Proofpoint-observed campaign from March-June 2023 sent approximately 120,000 phishing emails targeting over 100 organizations representing 1.5 million employees, with 39% of compromised users being C-level executives and 35%+ MFA-enabled. Post-compromise, attackers used Microsoft's 'My Sign-Ins' application to register their own MFA methods, enabling persistent access. Okta Threat Intelligence tracked a renewed high-volume campaign (O-UNC-035) active since at least March 2025, targeting M365, Google Workspace, Dropbox, and GitHub accounts. The kit infrastructure includes 80+ brand-impersonating domains (SAP Concur, DocuSign, Adobe Sign) and 65+ intermediate redirector domains, with a multi-step redirection chain through legitimate services including YouTube.
The primary defense against all three kits is phishing-resistant MFA (FIDO2/WebAuthn passkeys), which cannot be proxied, relayed, or device-code-hijacked. Secondary controls include blocking Device Code authentication flow in Entra ID Conditional Access, enforcing short session-token lifetimes with Continuous Access Evaluation, deploying Sigma/KQL correlation rules for impossible device shift detection, and monitoring sign-ins from hosting-provider IP ranges (DigitalOcean, Railway, Cloudzy, PacketHub, Hetzner).
MITRE ATT&CK techniques used in TL-2026-1888
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1606 Forge Web Credentials; T1621 Multi-Factor Authentication Request Generation
Persistence
T1078 Valid Accounts; T1098 Account Manipulation; T1137 Office Application Startup
Discovery
Collection
lateral-movement
T1550 Use Alternate Authentication Material
Initial Access
Resource Development
reconnaissance
Affected products and versions in Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy)
- Microsoft — Microsoft 365 / Entra ID
Vulnerable versions: All versions using OAuth 2.0 Device Code flow; All versions relying on TOTP/SMS/push MFA
Fixed in: Phishing-resistant MFA (FIDO2/WebAuthn) mitigates all three
Remediation for Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy)
Immediate actions
- Block Device Code authentication flow in Entra ID Conditional Access for users without keyboardless/IoT device needs
- Deploy Sigma/KQL correlation rules for impossible device shift (inconsistent User-Agent across auth correlation ID within 10 minutes)
- Block or alert on sign-ins from hosting-provider IP ranges: DigitalOcean, Railway (162.220.232.0/22, 162.220.234.0/22), Cloudzy, PacketHub, Hetzner, OVH
- Force re-authentication of potentially compromised accounts and revoke refresh tokens
- Inspect URLs for 150-char alphanumeric path with /index, /verify, or /validate endpoints
Workarounds
- Train users to never enter Microsoft device-login verification codes unless they personally initiated a device sign-in
- Treat unexpected MFA prompts and login-domain mismatches as high-priority indicators
- Educate users on browser-in-the-browser attack indicators
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn passkeys, hardware security keys) organization-wide
- Enforce short session-token lifetimes and Continuous Access Evaluation (CAE) in Entra ID
- Implement Conditional Access sign-in risk policies (high/medium/low risk → block or force MFA)
- Block legacy authentication via Conditional Access
- Deploy EDR with behavioral detection for anomalous token usage
- Configure Safe Links with high-confidence device code phishing alerts
Weaknesses (CWE) in Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy)
Timeline of Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy)
- EvilProxy PhaaS kit first observed in the wild, becomes one of the longest-running commercial AiTM phishing platforms targeting M365, Google Workspace, Dropbox, and GitHub.
- Proofpoint observes EvilProxy campaign sending ~120,000 phishing emails to 100+ organizations (1.5M employees), with 39% C-level targeting and 35%+ MFA-bypass success rate.
- Group-IB discloses W3LL OV6 AiTM phishing kit; Sneaky 2FA later reuses W3LL OV6 source code including identical User-Agent strings, GuzzleHttp cookie handling, and background image hashes.
- Sneaky Log operator registers sneakylog[.]store domain and begins developing the Sneaky 2FA AiTM phishing kit.
- Sneaky 2FA AiTM phishing kit first observed in the wild by Sekoia TDR team, circulating on Telegram via @SneakyLog_bot at ~$200/month.
- Sekoia publishes full technical analysis of Sneaky 2FA, documenting 55+ attacker-controlled domains, 33 compromised domains, User-Agent rotation technique, and the 'impossible device shift' detection signature.
- Sneaky 2FA adds Browser-in-the-Browser (BITB) functionality per CSO Online; ZeroBEC reports trusted sender abuse, route polymorphism, and M365 replay attacks. ~100 Sneaky 2FA domains tracked.
- Okta Threat Intelligence begins tracking a renewed high-volume EvilProxy campaign as O-UNC-035 (toolkit tracked as O-TA-041), targeting M365, Google Workspace, Dropbox, and GitHub with SAP Concur and DocuSign lures.
- EvilTokens PhaaS kit first observed in the wild by Sekoia TDR team, abusing OAuth 2.0 Device Authorization Grant flow — the first turnkey device code phishing kit.
- Huntress SOC observes initial alerts of Railway.com infrastructure being used for token replay against 344 organizations across 5 countries.
- EvilTokens campaign escalates: 16-day wave of device code phishing attacks affecting 340+ M365 organizations across 7+ countries, using Railway.com, Cloudflare Workers, and Vercel infrastructure.
- Sekoia reports over 900 confirmed EvilTokens pages via X-Antibot-Token header search, over 1,000 domains hosting EvilTokens pages, and 66+ phishing attachments collected.
- Microsoft Defender Security Research publishes analysis of AI-enabled device code phishing campaign, confirming EvilTokens as an escalation of Storm-2372, with AI-generated hyper-personalized lures and dynamic code generation.
- Cybersecurity News publishes consolidated report covering all three PhaaS kits (Sneaky 2FA, EvilTokens, EvilProxy) as a unified multi-kit threat landscape targeting US M365 accounts.
Sources cited for Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy)
- Three PhaaS Kits Targeting US Organizations (Cybersecurity News)
- Sneaky 2FA — Exposing a new AiTM Phishing-as-a-Service (Sekoia)
- Sneaky2FA Adds Browser-in-the-Browser Functionality (CSO Online)
- Sneaky 2FA Returns — Trusted Sender Abuse, Route Polymorphism, and M365 Replay (ZeroBEC)
- New Widespread EvilTokens Kit: Device Code Phishing as-a-Service (Sekoia Part 1)
- AI-Enabled Device Code Phishing Campaign (Microsoft Security Blog)
- How EvilTokens Turbocharges Old School Phishing with AI (Huntress)
- EvilTokens: Turning OAuth Device Codes into Full-Scale BEC Operations (Abnormal Security)
- EvilProxy Phishing Campaign (Okta Threat Intelligence)
- Cloud Account Takeover Campaign Leveraging EvilProxy (Proofpoint)
- EvilProxy Phishing Campaign Targets 120,000 M365 Users (BleepingComputer)
- W3LL OV6 AiTM Phishing Kit (Group-IB)
- EvilTokens: A Phishing Attack That Doesn't Steal Your Password (ESET WeLiveSecurity)
- Riding the Rails: Threat Actors Abuse Railway.com PaaS as M365 Token Attack Infrastructure (Huntress)
Detection coverage for TL-2026-1888
As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1888 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.