# Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials and Session Tokens

> Three distinct Phishing-as-a-Service (PhaaS) kits — Sneaky 2FA (AiTM reverse-relay, ~$200/mo, 100+ domains since Oct 2024), EvilTokens (OAuth Device Code abuse, 340+ M365 orgs across 7+ countries since Feb 2026), and EvilProxy (reverse-proxy AiTM, 100+ orgs globally since May 2022, tracked by Okta as O-TA-041) — actively target US organizations for M365 credential theft, session cookie hijacking, and downstream BEC operations. All three functionally bypass MFA by exploiting the structural gap between authentication validation and token/cookie provenance.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1888
- **ID:** TL-2026-1888
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Sneaky Log
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Three commercially available Phishing-as-a-Service (PhaaS) kits are actively targeting US organizations to compromise Microsoft 365 accounts by bypassing multi-factor authentication through fundamentally different technical approaches. Together they represent a structured escalation in the phishing-as-a-service ecosystem, each refining a distinct MFA-bypass technique into a turnkey product.

Sneaky 2FA (operated by 'Sneaky Log' via @SneakyLog_bot on Telegram, ~$200/month) employs an Adversary-in-the-Middle reverse-relay architecture. The victim clicks a phishing link or scans a QR code from a PDF attachment, passes through a Cloudflare Turnstile gate and IP-filtering layer, and lands on a cloned M365 login page. Credentials are POSTed to the phishing server, which relays them live to Microsoft's API. The victim completes real MFA against Microsoft's backend, and the session cookie is captured server-side. The kit rotates User-Agent strings across authentication steps (e.g., Safari-on-iOS for login, Chrome-on-Windows for MFA), enabling the 'impossible device shift' detection signature. First observed in October 2024 and formally disclosed by Sekoia in December 2024, the kit reuses source code from the W3LL OV6 AiTM kit (Group-IB, 2023). By early January 2025, over 100 Sneaky 2FA domains had been identified. In 2025, the kit added Browser-in-the-Browser (BITB) functionality per CSO Online reporting, and has been observed using trusted sender abuse, route polymorphism, and M365 replay attacks per ZeroBEC research. The operator infrastructure includes license-validation servers at sneakylog[.]store and 185.125.100[.]81, with cryptocurrency payments (BTC, USDT-TRC20, ETH, LTC) laundered through a third-party mixing service.

EvilTokens (first observed mid-February 2026, disclosed by Sekoia in March 2026) pioneers a fundamentally different approach: it never presents a fake login page or captures a password. Instead it weaponizes the OAuth 2.0 Device Authorization Grant flow — designed for keyboardless devices — against Microsoft 365. The attacker requests a device code from Microsoft's legitimate OAuth endpoint, then tricks the victim into entering the code at microsoft.com/devicelogin. The victim completes normal sign-in including MFA, and Microsoft issues access and refresh tokens directly to the attacker's already-polling client. The kit features dynamic code generation (the 15-minute timer starts only when the victim lands on the page), AI-generated hyper-personalized lures, and a backend API that converts refresh tokens to Primary Refresh Tokens (PRTs) for persistent access. The infrastructure spans thousands of Railway.com polling nodes, Cloudflare Workers, Vercel, and AWS Lambda, with the X-Antibot-Token custom HTTP header used for backend authentication. Over 340 M365 organizations across 7+ countries have been compromised since mid-February 2026. Post-compromise capabilities include 7 parallel Graph API reconnaissance queries, Azure resource enumeration, OWA session cookie generation, and automated inbox rule creation for BEC fraud. The kit is assessed by Sekoia as 'the first PhaaS to offer turnkey Microsoft device code phishing pages' and Microsoft's Defender Security Research confirmed the campaign as an escalation of the prior Storm-2372 device code phishing campaign from February 2025.

EvilProxy (tracked as O-TA-041 by Okta Threat Intelligence, operating since May 2022) is one of the longest-running commercial AiTM PhaaS platforms. It uses a reverse-proxy architecture that sits between the victim and the legitimate identity provider, proxying the entire authentication flow in real time including MFA challenges. The victim sees a convincing Microsoft-branded page with the target organization's name dynamically populated; the proxy captures both credentials and session cookies in transit. The kit features extensive anti-analysis: VM and browser fingerprinting, IP blocklisting via api.ipify.org, domain blocklisting, and bot detection that redirects scanners to the legitimate Microsoft login page. A Proofpoint-observed campaign from March-June 2023 sent approximately 120,000 phishing emails targeting over 100 organizations representing 1.5 million employees, with 39% of compromised users being C-level executives and 35%+ MFA-enabled. Post-compromise, attackers used Microsoft's 'My Sign-Ins' application to register their own MFA methods, enabling persistent access. Okta Threat Intelligence tracked a renewed high-volume campaign (O-UNC-035) active since at least March 2025, targeting M365, Google Workspace, Dropbox, and GitHub accounts. The kit infrastructure includes 80+ brand-impersonating domains (SAP Concur, DocuSign, Adobe Sign) and 65+ intermediate redirector domains, with a multi-step redirection chain through legitimate services including YouTube.

The primary defense against all three kits is phishing-resistant MFA (FIDO2/WebAuthn passkeys), which cannot be proxied, relayed, or device-code-hijacked. Secondary controls include blocking Device Code authentication flow in Entra ID Conditional Access, enforcing short session-token lifetimes with Continuous Access Evaluation, deploying Sigma/KQL correlation rules for impossible device shift detection, and monitoring sign-ins from hosting-provider IP ranges (DigitalOcean, Railway, Cloudzy, PacketHub, Hetzner).

## MITRE ATT&CK

- T1566 Phishing
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1137 Office Application Startup
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1550 Use Alternate Authentication Material
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1621 Multi-Factor Authentication Request Generation
- T1606 Forge Web Credentials
- T1589 Gather Victim Identity Information
- T1087 Account Discovery
- T1114 Email Collection
- T1583 Acquire Infrastructure

## Sources

- [Three PhaaS Kits Targeting US Organizations (Cybersecurity News)](https://cybersecuritynews.com/phaas-kits-targeting-us-organizations/)
- [Sneaky 2FA — Exposing a new AiTM Phishing-as-a-Service (Sekoia)](https://www.sekoia.com/blog/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service)
- [Sneaky2FA Adds Browser-in-the-Browser Functionality (CSO Online)](https://www.csoonline.com/article/4094165/sneaky2fa-phishing-tool-adds-ability-to-insert-legit-looking-urls.html)
- [Sneaky 2FA Returns — Trusted Sender Abuse, Route Polymorphism, and M365 Replay (ZeroBEC)](https://zerobec.com/blog/sneaky-2fa-returns-trusted-sender-tenant-branded-microsoft-365-replay)
- [New Widespread EvilTokens Kit: Device Code Phishing as-a-Service (Sekoia Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [AI-Enabled Device Code Phishing Campaign (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [How EvilTokens Turbocharges Old School Phishing with AI (Huntress)](https://www.huntress.com/blog/device-code-phishing-ai-mfa-bypass)
- [EvilTokens: Turning OAuth Device Codes into Full-Scale BEC Operations (Abnormal Security)](https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations)
- [EvilProxy Phishing Campaign (Okta Threat Intelligence)](https://www.okta.com/en-gb/blog/threat-intelligence/evil-proxy-phishing-campaign/)
- [Cloud Account Takeover Campaign Leveraging EvilProxy (Proofpoint)](https://www.proofpoint.com/uk/blog/email-and-cloud-threats/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level)
- [EvilProxy Phishing Campaign Targets 120,000 M365 Users (BleepingComputer)](https://www.bleepingcomputer.com/news/security/evilproxy-phishing-campaign-targets-120-000-microsoft-365-users/)
- [W3LL OV6 AiTM Phishing Kit (Group-IB)](https://www.group-ib.com/blog/w3ll-ov6-aitm-phishing-kit/)
- [EvilTokens: A Phishing Attack That Doesn't Steal Your Password (ESET WeLiveSecurity)](https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/)
- [Riding the Rails: Threat Actors Abuse Railway.com PaaS as M365 Token Attack Infrastructure (Huntress)](https://www.huntress.com/blog/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1888