3 PhaaS Kits Hijacking US Microsoft 365 MFA: Sneaky 2FA, EvilTokens & EvilProxy Teardown
If your enterprise engineering team relies on push notification or SMS multi-factor authentication (MFA) to secure your Microsoft 365 tenant, audit your active session logs immediately. Three sophisticated Phishing-as-a-Service (PhaaS) platforms—Sneaky 2FA, EvilTokens, and EvilProxy—are aggressively targeting US organizations to steal authenticated M365 session cookies and OAuth access tokens without cracking passwords.
Why Legacy MFA Fails Against AiTM & OAuth Hijacking
Standard MFA validates only that an authentication event occurred, without verifying where the resulting session cookie or access token lands. When a threat actor positions a real-time reverse proxy between your employee and Microsoft's legitimate cloud endpoints, your target completes their real MFA challenge directly against Microsoft, only for the attacker's server to skim the validated token mid-transit.
Once harvested, adversaries import the session cookie into their local environment to achieve silent administrative access across Outlook Exchange archives, SharePoint documentation vaults, and Teams channels to orchestrate downstream Business Email Compromise (BEC) fraud.
Technical Threat Matrix: Sneaky 2FA vs. EvilTokens vs. EvilProxy
| Threat Attribute | Sneaky 2FA | EvilTokens | EvilProxy |
|---|---|---|---|
| Attack Technique | AiTM Reverse-Relay Phishing Page | OAuth 2.0 Device Code Grant Abuse | Inline Real-Time Reverse-Proxy |
| Credential Target | Passwords & Session Cookies | OAuth Access & Refresh Tokens Only | Passwords & Session Cookies |
| MFA Interaction | Relayed live; cookie skimmed post-auth | Victim authorizes attacker OAuth app | Real MFA proxied inline mid-flight |
| Primary Evasion | Cloudflare Turnstile gates, IP blocklists | Legitimate Microsoft authentication URLs | VM detection, browser fingerprinting |
| Commercial Model | ~$200/month via Telegram (@SneakyLog_bot) |
Turnkey BEC operations environment | Established dark web PhaaS licensing |
High-Fidelity Detection Tell: "Impossible Device Shift"
Security engineers tracking Sneaky 2FA deployments identified a high-fidelity behavioral signature known as the Impossible Device Shift. During live relay attempts, the script submits initial user login credentials using a hardcoded iOS Safari User-Agent, before resolving the subsequent multi-factor authentication challenge using a Windows Chrome User-Agent within the exact same authentication correlation ID.
Defensive SOC engineers can construct automated KQL correlation rules in Microsoft Entra ID logs to flag conflicting User-Agent strings occurring within a 10-minute duration window.
Verified Indicators of Compromise (IOCs - August 2026)
-
Sneaky 2FA Path Signature:
https://<domain>/[a-zA-Z0-9]{150}/index,/verify, or/validate -
Sneaky 2FA License C2 Server:
sneakylog[.]store|185.125.100[.]81 -
EvilTokens Central MailVault C2:
techroboticslabmade[.]com|macmamo[.]com|acb[.]af -
EvilTokens Railway Token Replay Subnets:
162.220.232.0/22|162.220.234.0/22|216.126.227[.]101 -
EvilTokens Exploit User-Agents:
python-requests/2.31.0|kali365-live/1.0.0 -
EvilProxy OAuth Relay Pattern:
lmo.msdnmail[.]net/common/oauth2/v2.0/authorize?client_id=...
Access the Complete C-Suite Defense & Mitigation Guide
To inspect comprehensive NIST SP 800-63B zero-trust hardening architectures, continuous access evaluation (CAE) configuration steps, and verified FIDO2 passkey integration workflows, read our complete technical advisory here:
👉 Read the Full Official CyberUpdates365 Advisory: 3 PhaaS Kits Bypassing M365 MFA
Technical threat intelligence report audited and verified by the **CyberUpdates365 Threat Intelligence Unit* (August 2026).*
Top comments (0)