Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar

The Hacker News reports that the Sneaky 2FA phishing kit, a PhaaS offering, has incorporated BitB (Browser-in-the-Browser) functionality, making it easier for attackers to mount credential-stealing campaigns at scale. According to Push Security, BitB is designed to mask phishing URLs by simulating in-browser authentication, with phishing pages mirroring a pop-up window and using an iframe to point to a malicious server.

The piece notes that BitB was first documented by security researcher mr.d0x in March 2022, describing how HTML and CSS can create fake browser windows to impersonate login pages. In a observed attack chain, victims arriving at a suspicious URL such as “previewdoc[.]us” encounter a Cloudflare Turnstile bot check before being shown a page with a “Sign in with Microsoft” button that leads to a Microsoft‑style login form loaded via the BitB technique.

Once credentials are entered, the information and session details are exfiltrated to the attacker, enabling account takeovers, with further use of bot protection and conditional loading to target or filter victims. The report also highlights the use of downgrade attacks and mentions Tycoon as an example of adversary-in-the-middle phishing kits that can push victims towards less secure options.