Phishing-as-a-Service Evolves: Sneaky2FA Adds Browser-in-the-Browser Attacks in 2024
Executive Summary
In early June 2024, cybersecurity researchers reported that the Sneaky2FA phishing-as-a-service (PhaaS) kit has adopted the Browser-in-the-Browser (BitB) attack tactic, previously used by red teamers, to improve the effectiveness of credential phishing campaigns. This new feature enables threat actors using the Sneaky2FA service to launch highly convincing fake login pop-ups, closely mimicking legitimate authentication flows, including prompts for multifactor authentication (MFA). The update broadens the risks for both organizations and individuals, as traditional indicators of phishing are increasingly hard to spot. The deployment of BitB tactics by a turnkey phishing kit marks a concerning development in the automation and commercial accessibility of advanced cybercrime techniques.
This incident underscores the escalating sophistication of phishing attacks driven by the commoditization of offensive security techniques. Organizations face renewed urgency to revisit their authentication controls, user awareness training, and phishing-resistant MFA, as adversary innovation quickly outpaces conventional defense measures.
Why This Matters Now
Phishing kits implementing Browser-in-the-Browser techniques greatly increase the likelihood of users falling victim to credential theft, particularly bypassing MFA protections. As these advanced methods spread through Phishing-as-a-Service platforms, organizations of all sizes are at heightened risk, making immediate improvements in anti-phishing education and technical defenses critical.
Attack Path Analysis
The attack begins with users lured to a fraudulent Browser-in-the-Browser (BitB) phishing site operated via the Sneaky2FA PhaaS kit, leading to credential and 2FA token capture. Adversaries leverage these stolen credentials to gain unauthorized access and attempt privilege escalation, potentially targeting sensitive cloud assets. With escalated access, attackers may traverse internal cloud environments searching for additional resources or data. Malicious traffic establishes outbound connections to command and control infrastructure for attacker persistence and coordination. Exfiltration follows, with data or credentials sent out through covert or authorized channels. Ultimately, the impact may include unauthorized data access, account takeover, or further attacks enabled by the compromised foothold.
Kill Chain Progression
Initial Compromise
Description
Users are deceived into entering credentials and 2FA tokens into a BitB phishing page, resulting in account credential compromise.
Related CVEs
CVE-2021-21176
CVSS 6.5An inappropriate implementation in full screen mode in Google Chrome prior to version 89.0.4389.72 allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Products:
Google Chrome – < 89.0.4389.72
Exploit Status:
proof of conceptCVE-2021-37994
CVSS 6.5An issue in Google Chrome prior to version 95.0.4638.54 allows a remote attacker to bypass navigation restrictions through a crafted HTML page.
Affected Products:
Google Chrome – < 95.0.4638.54
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Phishing: Spearphishing via Link
Browser Extensions
Email Collection
Browser Session Hijacking
Steal Web Session Cookie
Modify Authentication Process: Multi-Factor Authentication Interception
User Execution: Malicious Link
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-factor Authentication Implementation
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management
Control ID: Art. 9
CISA ZTMM 2.0 – Identity and Access Management – Authentication Protection
Control ID: ID.AM-1
NIS2 Directive – Security in Network and Information Systems
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
Browser-in-the-Browser phishing attacks targeting financial credentials threaten zero trust segmentation and encrypted traffic compliance, enabling account takeovers and fraud.
Financial Services
Sneaky2FA PhaaS kit poses severe credential theft risks requiring enhanced egress security, threat detection capabilities, and multi-factor authentication bypass protection.
Information Technology/IT
IT infrastructure faces lateral movement risks from sophisticated phishing attacks, demanding robust east-west traffic security and multicloud visibility controls.
Health Care / Life Sciences
Deceptive phishing threatens patient data through compromised credentials, violating HIPAA compliance and requiring enhanced anomaly detection and secure hybrid connectivity.
Sources
- Sneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attackhttps://www.bleepingcomputer.com/news/security/sneaky2fa-phaas-kit-now-uses-redteamers-browser-in-the-browser-attack/Verified
- CVE-2021-21176: Google Chrome vulnerability analysis and mitigationhttps://www.wiz.io/vulnerability-database/cve/cve-2021-21176Verified
- CVE-2021-37994: vulnerability analysis and mitigationhttps://www.wiz.io/vulnerability-database/cve/cve-2021-37994Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Enforcing zero trust segmentation, egress policy enforcement, real-time threat detection, and centralized visibility would have limited unauthorized access, contained attacker movement, and blocked exfiltration attempts, thus disrupting the kill chain at several points.
Control: Multicloud Visibility & Control
Mitigation: Faster detection of anomalous user authentication patterns.
Control: Zero Trust Segmentation
Mitigation: Limits access to only permitted resources even when credentials are compromised.
Control: East-West Traffic Security
Mitigation: Blocks lateral traversal between workloads, reducing attack surface.
Control: Egress Security & Policy Enforcement
Mitigation: Denies unauthorized outbound connections and detects C2 traffic.
Control: Encrypted Traffic (HPE)
Mitigation: Detects and blocks unencrypted or suspicious exfiltration attempts.
Rapidly detects and enables mitigation of malicious activity before larger impact occurs.
Impact at a Glance
Affected Business Functions
- User Authentication
- Access Control
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of user credentials and session tokens, leading to unauthorized access to sensitive information.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy zero trust segmentation to restrict account movement and enforce least-privilege access.
- • Enable centralized visibility and anomaly detection to flag suspicious logins or lateral actions in real time.
- • Enforce stringent egress filtering to limit unauthorized outbound connections and block data exfiltration channels.
- • Utilize inline threat detection and real-time policy enforcement to quickly identify and respond to evolving attacker behaviors.
- • Regularly review and test identity/access controls and multi-factor authentication workflows against phishing and token replay attacks.
