Salty2FA Takes Phishing Kits to Enterprise Level

A recent phishing campaign using the Salty2FA kit shows adversarial tooling moving to enterprise‑grade capability, researchers said. According to Ontinue, the kit features subdomain rotation, the abuse of legitimate platforms for initial access, and dynamic branding that can mimic six different MFA methods, all supported by increasingly advanced evasion tactics.

The campaign workload was built in a multistage infrastructure designed to resemble legitimate software development, with attackers redirecting victims to Cloudflare Turnstile after the phishing page loads. Ontinue noted that attackers registered a trial account on the legitimate‑domain Aha[.]io on Sept. 3 to impersonate a known business, anchoring the lure with a OneDrive sharing page and a link to click.

The Salty2FA toolkit also includes geo‑blocking, ASN/IP filtering, and JavaScript‑based anti‑debugging to hinder researchers and SOCs, highlighting how phishing is maturing into enterprise‑grade operations. Defenders are urged to deploy layered protections that extend beyond email and network security to detect and stop such campaigns before data is compromised.