New ‘Sneaky 2FA’ Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass

A new phishing kit, dubbed “Sneaky 2FA,” is targeting Microsoft 365 accounts by bypassing two-factor authentication (2FA) codes. The kit, sold as phishing-as-a-service (PhaaS) on Telegram, employs various anti-bot and anti-analysis measures to evade detection. Sekoia researchers believe the kit may be based on the W3LL Panel, another phishing kit linked to the W3LL Store phishing syndicate.