A new phishing-as-a-service (PhaaS) platform, known as Rockstar 2FA, is enabling adversary-in-the-middle (AiTM) attacks to steal Microsoft 365 credentials and bypass multifactor authentication (MFA). Specifically, AiTM phishing is a technique that uses specialized tools to allow a threat actor to act as a proxy between the victim and the legitimate login portal of an application.

Rockstar 2FA operates by mimicking Microsoft 365 login pages to trick users into providing their credentials. The AiTM server forwards these details to Microsoft’s legitimate services for authentication, capturing the session cookie that allows unauthorized access to the account without needing credentials.

According to Trustwave, Rockstar 2FA builds on earlier phishing kits DadSec and Phoenix, which saw widespread use in 2023. The Rockstar 2FA platform has quickly gained popularity in the cybercrime community since August 2024, offering access for two weeks for $200. There’s also a two-week API renewal service for $180. It includes numerous features such as randomized source code (to avoid detection) and Cloudflare’s Turnstile Captcha (for screening victims).

Over 5,000 phishing domains linked to Rockstar 2FA have been launched since May 2024, facilitating campaigns that use legitimate email marketing platforms or compromised accounts. These campaigns leverage document-sharing notifications, password reset alerts, and payroll messages to deceive targets. To prevent their malicious links from being automatically blocked, threat actors use QR codes, link-shortening services, and PDF attachments.

Sophisticated screening mechanisms underpin these operations. Visitors suspected of being bots, researchers, or irrelevant targets are redirected to harmless car-themed decoy pages, while legitimate victims are shown deceptive login prompts.

Rockstar 2FA has enjoyed a steady rise in notoriety, despite law enforcement agencies cracking down on PhaaS platforms. The platform’s low cost and ease of use pose significant risks, as it allows for widespread, highly effective phishing campaigns.