New Phishing Kit Bypasses Two-Factor Protections

A new phishing kit bypasses two-factor authentication through session hijacking and real-time credential interception from services like Gmail, Yahoo, AOL and Microsoft 365.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

First advertised on cybercrime forums in January, Astaroth uses an evilginx-style reverse proxy to intercept and manipulate traffic between victims and legitimate authentication, according to a report by SlashNext.

Acting as a man-in-the-middle, it captures login credentials, tokens, and session cookies in real time, rendering two-factor protections useless.

Unlike traditional phishing kits that rely on static fake login pages to steal primary credentials, Astaroth intercepts authentication data the moment it is entered, enabling cybercriminals to gain full access to compromised accounts instantly, without needing additional authentication from victims.

Once victims click a phishing link, they are redirected to a malicious server that operates as a reverse proxy, mirroring the legitimate login page. With valid SSL certificates in place, users see no security warnings, making the attack nearly impossible to detect.

When victims enter their usernames and passwords, Astaroth captures them in real-time before forwarding requests to the actual authentication service.

To fully bypass 2FA, the phishing kit automatically intercepts one-time passcodes generated via SMS, authentication apps or push notifications. Cybercriminals are alerted immediately through a web panel interface and Telegram notifications, allowing them to take control of accounts before victims suspect anything.

Astaroth further enhances its effectiveness by capturing session cookies, which help attackers bypass authentication altogether. By injecting stolen cookies into their browsers, hackers can impersonate victims without needing usernames, passwords, or 2FA tokens.

The phishing kit is available on cybercrime marketplaces for $2,000, with six months of continuous updates. Sellers promote Astaroth across Telegram and underground forums, offering live demonstrations to potential buyers.

To attract more customers, the developers openly share details on their techniques for bypassing security features like reCAPTCHA and BotGuard.

Astaroth also includes custom hosting options such as bulletproof hosting, making it resistant to takedown attempts by law enforcement. Hosted in jurisdictions with weak regulatory oversight, the kit ensures cybercriminals can operate without disruption.

J Stephen Kowski, field CTO at SlashNext, told Information Security Media Group that a key takeaway is that even strong login processes can be defeated by threat actors who can immediately grab 2FA codes and session data.

“Security teams should use fast, real-time threat detection across web, email and mobile channels while also teaching users to spot fake pages,” Kowski said.

SlashNext researchers, who discovered Astaroth, recommend organizations deploy AI-powered security tools to detect and block phishing attempts before they reach users.