New BlackForce Phishing Kit Bypasses Multifactor Authentication

Zscaler reports on the BlackForce phishing kit, which conducts targeted phishing with a vetting system and live operator takeover to capture credentials and bypass multi-factor authentication using Man-in-the-Browser techniques; attackers receive real-time alerts and exfiltrate data (including via Telegram), while the kit evades detection by incorporating legitimate React code to appear benign.