Rockstar 2FA Phishing Service Targets Microsoft 365 Users with AiTM Attacks

A new threat called the Rockstar 2FA Phishing Service is making waves. This phishing-as-a-service (PhaaS) toolkit has caught the attention of researchers due to its ability to bypass two-factor authentication (2FA) and exploit Microsoft 365 users using advanced AiTM (adversary-in-the-middle) attacks.

These attacks are not only sophisticated but also accessible to even novice cybercriminals.

Key Takeaway to AiTM Attacks

• The Rockstar 2FA Phishing Service demonstrates that even accounts protected by multi-factor authentication are not immune to attacks, making awareness and vigilance more important than ever.

What is the Rockstar 2FA Phishing Service?

The Rockstar 2FA Phishing Service is a malicious toolkit designed to help attackers steal credentials and session cookies from Microsoft 365 users. It specifically employs AiTM attacks, allowing cybercriminals to intercept sensitive information during user logins.

Here’s how it works:

This service is sold through subscription models for $200 (two weeks) or $350 (a month), making it accessible even to attackers with minimal technical expertise.

How Rockstar 2FA Operates

Email campaigns leveraging the Rockstar 2FA Phishing Service use creative lures to trick users. Attackers often disguise phishing links in:

• QR codes
• Shortened URLs
• Document attachments

These emails appear to come from legitimate sources, such as file-sharing notifications or requests for e-signatures.

Once victims click on the links, they are redirected to fake login pages that look almost identical to the real ones. These pages collect login credentials and immediately send them to the attacker’s server.

AiTM techniques are then used to intercept session cookies, enabling the attacker to gain access to the account without triggering 2FA alerts.

Why Is AiTM Attack Dangerous?

An AiTM attack is particularly alarming because it bypasses traditional defenses like 2FA. Even if a user enters a one-time password or verification code, the attacker can intercept it in real time and use it to access the account.

Real-Life Example

This isn’t the first time we’ve seen AiTM attacks. In 2022, a phishing campaign exploited AiTM techniques to target Google Workspace users.

The attackers used fake login pages to steal credentials and access sensitive emails. This highlights how AiTM attacks continue to evolve and remain a serious threat.

Who Is Behind Rockstar 2FA?

Microsoft researchers have linked Rockstar 2FA to a developer group they track as Storm-1575. This group has a history of creating phishing kits, including the earlier DadSec platform.

The group advertises Rockstar 2FA on platforms like Telegram and ICQ, which are popular among cybercriminals. By using trusted services such as Google Docs Viewer and Microsoft Dynamics 365 to host phishing links, they increase the likelihood of victims falling for their scams.

How to Protect Yourself from Rockstar 2FA Phishing Service

• Stay Cautious with Emails
  Avoid clicking on links or opening attachments from unknown sources. Verify the sender’s identity before taking any action.
• Use Advanced Security Measures
  Consider using security tools that monitor and block suspicious URLs or attachments.
• Educate Your Team
  If you’re in an organization, conduct regular training on identifying phishing attempts.
• Implement Continuous Monitoring
  Use monitoring tools to detect unusual login patterns or unauthorized access to accounts.

About Rockstar 2FA

The Rockstar 2FA Phishing Service is an updated version of the DadSec phishing kit, developed and distributed by a group tracked as Storm-1575. This group specializes in creating sophisticated phishing tools that exploit modern security measures like 2FA.

Rounding Up

Rockstar 2FA and AiTM attacks serve as a wake-up call for individuals and organizations to stay vigilant and adopt advanced cybersecurity measures. Protecting sensitive information has never been more crucial.

FAQs