Accessibility links

Facebook   X   LinkedIn   Email

Sneaky Attacks Steal 2FA and Your Credentials

By: Jim Stickley and Tina Davis
June 10, 2025

Microsoft 365 users worldwide need to be on alert for hackers bypassing 2FA security to steal their sensitive credentials. Over 1.3 million companies in the U.S. use Microsoft 365 (MS Office), and security professionals warn these attacks aren’t limited to this software alone. Here’s what you should know about these devious cyberattacks, beyond the fact that they are ongoing.

Getting Around 2FA

With 2FA being one of the most widely used verification protections today, it’s no wonder hackers look for ways to get around it. And one of the most widely used methods of doing so is phishing. Since last year, Phishing-as-a-Service (PhasS) kits called Sneaky 2FA have been available for sale online. These kits are designed to bypass a user’s 2FA. Once done, a phishing website that looks authentic, like an MS Office login page, pops up. And before you know it, you’re smack dab in the middle of a cybercrime in motion.

It's not just Sneaky 2FA that’s available for these devious attacks. Other 2FA bypass software for sale called Rockstar 2FA and another known as FlowerStorm are getting in on the action. One thing is for sure, if there’s a buck to be made, other cybercriminals want theirs.

Bypassing 2FA Theft

Although experts don’t necessarily agree on the best way to mitigate 2FA theft, ideas are circulating. There’s a Privileged Access Management tool that limits harm from 2FA theft. Using a password manager, unique and fortified passwords and credentials are all possibilities. But one way of avoiding 91% of cyberattacks is not getting phished in the first place. One of the most effective tools we have for that is using good old common sense.

For extra caution avoiding 2FA compromise, passkeys replace the need for using passwords. Another is using one-time-passwords (OTPs) available only once for logins. Both are unique ways to log in without giving away the keys to your identity.

No one would disagree that it’s a jungle out there trying to stay safe online. But for every new cybercrime that pops up, there are options combatting it thanks to the good guys on our side.



Email Scams Threaten Extortion And Blackmail

Scams & Phishing

Email Scams Threaten Extortion And Blackmail

An uptick in email scams has cybersecurity professionals concerned, and for good reason. Symantec researchers found that in the first five months of 2019, they prevented almost 300 million extortion email attacks from going forward. Just some of those discovered include blackmail, sextortion, bombs, hit men, and malware threats. The researchers also determined the average cost of paying demands over a 30 day period was $1.2 million in 243 Bitcoin transactions. READ FULL STORY
Good Security Habits Can Go A Long Way In A New Year

Your Security

Good Security Habits Can Go A Long Way In A New Year

It’s a new year! And while everyone will face new cyber risks going forward, it makes it more important than ever for individuals to assume responsibility for safeguarding their devices and data. Threats stay the same, but they also evolve to become more dangerous and new ones pop up like the cork of a champagne bottle. Protecting yourself from all of this begins with education and heeding the advice of cybersecurity experts. While we all think we know all of this already, anyone can become a victim of cybercrime when the circumstances are right. READ FULL STORY
Has Your Account Been Compromised? Five Cyber Smart Tips Everyone Can Use

Your Security

Has Your Account Been Compromised? Five Cyber Smart Tips Everyone Can Use

The transition to living life through our devices has become very real for scores of people and businesses. By now, the coronavirus has changed our lives in ways we never expected. This transition includes doing most things from home. Unfortunately, adapting to online life also gives bad actor’s a cornucopia of targets to exploit. There are proactive steps to take when you suspect an account may be compromised, including ways to help keep it from happening to begin with. READ FULL STORY
Microsoft Requires 2FA Login for Azure Cloud Users Starting in October

Corporate Security

Microsoft Requires 2FA Login for Azure Cloud Users Starting in October

According to Microsoft, the mammoth software company will soon be requiring their Azure clients to apply two-factor authentication (2FA) to login to the cloud platform. The 2FA mandate begins in October as part of a $20 billion investment in Microsoft’s future cybersecurity. Creating their “Secure Future Initiative” (SFI), the tech giant says the 2FA requirement is part of the project’s multi-billion-dollar plan to bolster security. Microsoft provided a two month notice to Azure users about the 2FA mandate rolling out in two parts starting soon. READ FULL STORY
Malware Upgrades Attack On Banking Customers

Scams & Phishing

Malware Upgrades Attack On Banking Customers

A banking malware is making its way through the Americas and North America could be next. BBTok banking malware first discovered in 2020 is back on the scene with significant upgrades. One of the advancements tricks users into supplying sensitive banking information through phishing links and bogus web pages. BBTok's victim list is rapidly growing, with the threat actors suspected of being from Brazil. But you can be sure, it isn't only a threat there. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.