Sneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attack

Sneaky2FA, a widely used phishing-as-a-service targeting Microsoft 365, has added Browser-in-the-Browser (BitB) pop-up capability that mimics legitimate Microsoft login windows to steal both credentials and active session tokens via an AitM reverse-proxy; the kit adapts the fake pop-up to the victim's OS/browser and uses heavy obfuscation and conditional loading to evade detection.