Mamba 2FA Cybercrime Kit Targets Microsoft 365 Users

Sekoia researchers report a commercial phishing-as-a-service named Mamba 2FA that targets Microsoft 365 users with AitM phishing pages imitating OneDrive, SharePoint, Microsoft sign-in, or voicemail links; it mirrors enterprise branding, bypasses one-time-code and push 2FA, supports Entra ID/AD FS/SSO and consumer accounts, and immediately exfiltrates harvested credentials and cookies to an attacker-controlled Telegram bot. The kit has been offered on underground channels since at least March (used in campaigns since November 2023) and is sold for about $250/month.