Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real

According to Malwarebytes, attackers are adopting a technique called Browser-in-the-Browser, or BitB, to present fake sign-in windows that mimic real browser prompts. A Phishing-as-a-Service kit named “Sneaky 2FA” is enabling these capabilities on the criminal marketplace, with customers receiving a licensed, obfuscated version of the source code.

The fake sign-in window is created with HTML and CSS and even features a convincing address bar that displays the legitimate website’s URL, making the deception hard to spot at first glance. Password managers can help, as they are designed to recognise only legitimate browser login forms and may refuse to autofill suspicious HTML fakes masquerading as browser windows. The campaigns use short-lived domains and “burn and replace” them to stay ahead of blocklists, complicating efforts to block these attacks.

Malwarebytes emphasises pairing a password manager with multi-factor authentication to provide the best protection and advises users to be cautious with unsolicited messages and links.