Mamba 2FA: A new contender in the AiTM phishing ecosystem

Sekoia TDR analyzed and documented Mamba 2FA, a commercially offered AiTM phishing kit that spoofs Microsoft 365 login pages (via HTML attachments and link domains) and uses Socket.IO relay servers to capture credentials, cookies and non-phishing-resistant MFA responses; the report details URL/template structures, relay/link domain and IP IOCs, infrastructure changes (including use of IPRoyal proxies), evidence of widespread use since late 2023, and provides detection opportunities for SOCs and CERTs.