Cybersecurity researchers are warning about malicious email campaigns leveraging a phishing-as-a-service (PhaaS) toolkit called Rockstar 2FA with an aim to steal Microsoft 365 account credentials.”This campaign employs an AitM [adversary-in-the-middle] attack, allowing attackers to intercept user credentials and session cookies, which means that even users with multi-factor authentication (MFA) enabled can still be vulnerable,” Trustwave researchers Diana Solomon and John Kevin Adriano said.

Rockstar 2FA is assessed to be an updated version of the DadSec (aka Phoenix) phishing kit. Microsoft is tracking the developers and distributors of the Dadsec PhaaS platform under the moniker Storm-1575.

Some of the promoted features of Rockstar 2FA include two-factor authentication (2FA) bypass, 2FA cookie harvesting, antibot protection, login page themes mimicking popular services, fully undetectable (FUD) links, and Telegram bot integration.

It also claims to have a “modern, user-friendly admin panel” that enables customers to track the status of their phishing campaigns, generate URLs and attachments, and even personalize themes that are applied to the created links.

Besides using legitimate link redirectors (e.g., shortened URLs, open redirects, URL protection services, or URL rewriting services) as a mechanism to bypass antispam detection, the kit incorporates antibot checks using Cloudflare Turnstile in an attempt to deter automated analysis of the AitM phishing pages.

The disclosure comes as Malwarebytes detailed a phishing campaign dubbed Beluga that employs .HTM attachments to dupe email recipients into entering their Microsoft OneDrive credentials on a bogus login form, which are then exfiltrated to a Telegram bot.