Mamba 2FA Uses AiTM Phishing to Bypass MFA and Hijack Microsoft 365 Accounts
Summary
The article analyzes Mamba 2FA’s AiTM phishing tactics and describes Darktrace detections of compromised Microsoft 365 accounts, including unusual logins, mailbox-rule changes, and attempts to register authenticator apps.
Key points
- Mamba 2FA uses convincing Microsoft-themed phishing pages and real-time relays to capture credentials and MFA codes, enabling attackers to access accounts.
- The kit targets phishing-vulnerable MFA methods such as one-time passwords and push notifications.
- Reported evasion tactics include sandbox detection, frequently rotated URLs, and HTML email attachments with redirecting JavaScript.
- Darktrace observed unusual Microsoft 365 logins followed by mailbox-rule changes, sensitive email and file access, attempted messages, and authenticator-app registration.
- Darktrace says its tools detected the activity and temporarily disabled affected accounts; a SOC investigation confirmed one account compromise.
- The article also says Darktrace Email detected and blocked related phishing emails in networks where the tool was deployed.
Article Details
- Attack Vectors
- Mamba 2FA phishing pages imitate Microsoft services such as OneDrive and SharePoint and use Base64-encoded URL parameters.
- HTML email attachments containing hidden JavaScript redirect recipients to phishing pages.
- The AiTM kit relays credentials and MFA tokens in real time to attackers, enabling account access after users enter them.
- After account access, observed activity included creating an email rule and attempting to register an authenticator app.
- Defensive Notes
- Monitor for unusual SaaS login locations, rare external endpoints, anomalous mailbox rules, and changes to authentication settings.
- Inspect email for suspicious URLs, HTML attachments containing JavaScript, unexpected sender-recipient relationships, and redirect links.
- The article reports that Darktrace detected and blocked campaign activity, including by disabling affected SaaS accounts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 102[.]68[.]111[.]240 | Rare external login endpoint observed during account activity associated with the campaign. |
| IPV4 | 45[.]133[.]172[.]86 | Suspicious login IP linked by the article to the Mamba 2FA campaign. |
| IPV6 | 2607:5500:3000:1cab::2 | Listed as a possible Mamba 2FA relay server. |
MITRE ATT&CK
T1056 · Input CaptureMamba 2FA phishing pages capture usernames, passwords, and MFA tokens entered by users.T1098 · Account ManipulationObserved activity included attempts to register a new authenticator app on compromised SaaS accounts.T1114 · Email CollectionThe article describes creating mailbox rules to conceal activity and redirect selected emails.T1218 · System Binary Proxy ExecutionThe article reports sandbox detection and redirection to harmless pages to evade analysis.T1557 · Adversary-in-the-MiddleThe AiTM kit relays and manipulates communications between users and login services to capture credentials and MFA tokens.T1566 · PhishingThe article describes phishing emails with deceptive links and HTML attachments used to direct recipients to phishing pages.
People
Malware
Vendors
Products
Microsoft 365 Apps for Enterpriseexample of a PhaaS strain with AiTM capabilities that has emerged as a significant threat to users of Microsoft 365 and other enterprise systems. Discovered in May 2024, Mamba 2FA employs advanced AiTM tactics toMicrosoft OneDriveMamba 2FA employs highly convincing phishing pages that closely mimic legitimate Microsoft services like OneDrive and SharePoint. These phishing URLs are crafted with a specific structure, incorporating Base64-encodedMicrosoft SharePointhighly convincing phishing pages that closely mimic legitimate Microsoft services like OneDrive and SharePoint. These phishing URLs are crafted with a specific structure, incorporating Base64-encoded parameters.Socket.IOA standout feature of Mamba 2FA is its use of the Socket.IO JavaScript library. This library facilitates real-time communication between the phishing page and the attackers' backend servers. As users input sensitive
Countries
NigeriaHowever, this time it was from a source IP located in Lagos, Nigeria, which no other user on the network had been observed connecting from.United Kingdomsuspicious IP address, 45.133.172[.]86, linked to ASN AS174 COGENT-174. This IP, originating from the UK, successfully passed through MFA validation.United StatesOn July 23, a SaaS user was observed logging in from a rare ASN and IP address, 2607:5500:3000:fea::2, originating from the US and successfully passed through MFA authentication.