Watch Out for Salty2FA: New Phishing Kit Targeting US and EU Enterprises

According to ANY[.]RUN, Phishing-as-a-Service platforms continue to evolve and Salty2FA is a new entrant designed to bypass multiple two-factor authentication methods and slip past traditional defenses. The Salty2FA kit has been spotted in campaigns targeting US and EU enterprises across finance, energy, telecom and other industries, with a multi-stage execution chain and evasive infrastructure that can intercept credentials and 2FA codes.

ANY[.]RUN analysts map Salty2FA campaigns as active across the United States and Europe, with campaigns dating momentum to June 2025 and confirmed activity since late July, generating dozens of fresh analysis sessions daily. The attack chain adds realism through a multi-stage flow: an email lure, redirect to a fake login, credential theft, and a 2FA bypass capable of intercepting push, SMS or voice verification.

In practice, the email lure seeks urgency around a “External Review Request” or “payment correction,” and the phishing page can prompt for codes while Cloudflare protections are bypassed, underscoring the need for behavioural detection and sandbox detonation as part of enterprise defences. Salty2FA’s rising sophistication reinforces why MFA policies favour app-based or hardware tokens and why SOCs should integrate sandbox results into SIEM/SOAR workflows.