Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real

Researchers observed a phishing campaign leveraging a Phishing-as-a-Service kit dubbed "Sneaky 2FA" that creates highly convincing fake browser pop-up login windows (Browser-in-the-Browser) to capture credentials; attackers tailor the fake window to the visitor's OS/browser, selectively display pages to high-value targets, and use short‑lived domains to evade blocks. Recommended mitigations include consistent use of password managers, multi-factor authentication, cautious link handling, and heuristic browser protections such as Malwarebytes Browser Guard.