New Salty 2FA PhaaS Attacking Microsoft 365 Users to Steal Login Credentials

A sophisticated new Phishing-as-a-Service (PhaaS) framework dubbed “Salty 2FA” has emerged as a significant threat to Microsoft 365 users across the US and European industries.

This previously undocumented platform employs advanced obfuscation techniques and multi-stage execution chains specifically designed to bypass two-factor authentication mechanisms while stealing corporate credentials.

The framework targets organizations spanning finance, telecommunications, energy, logistics, and educational sectors through carefully crafted phishing campaigns based on ANY.RUN Sandbox analysis.

The malware distinguishes itself through a unique domain infrastructure pattern that combines compound domains in “.com” zones with domains registered under Russian “.ru” top-level domains.

This distinctive pairing creates a complex web of redirections and payload delivery mechanisms that have helped the platform evade traditional detection systems.

Victims receive phishing emails containing various lures, including fake voice messages, document access requests, and billing statements that redirect them to convincing Microsoft login replicas.

ANY.RUN analysts identified this previously unknown PhaaS framework during a routine phishing campaign, where they discovered multiple sandbox sessions exhibiting similar behavioral patterns despite using different domains and obfuscation techniques.

The consistent use of Cloudflare Turnstile protection combined with the distinctive domain pairing initially flagged these campaigns as potentially related, leading to the comprehensive analysis that revealed Salty 2FA’s full capabilities.

The platform demonstrates considerable sophistication in its ability to intercept and process multiple two-factor authentication methods, including push notifications, SMS codes, voice calls, and authenticator app tokens.

This capability extends the attack beyond simple credential theft, allowing threat actors to maintain persistent access to compromised accounts even when traditional 2FA protections are in place.

Multi-Stage Execution Chain and Obfuscation Techniques

Salty 2FA’s technical architecture relies on a carefully orchestrated five-stage execution process designed to resist analysis and detection.

The initial stage begins with an obfuscated JavaScript function that serves as the entry point, containing inspirational quote comments as noise to complicate static analysis.

The framework employs sophisticated element ID encoding using Base64 and XOR operations with a fixed generated value, making dynamic analysis significantly more challenging.

All front-end logic relies on jQuery calls to dynamically generated element identifiers, which must be decoded through a dedicated routine before manipulation.

The platform incorporates multiple anti-analysis mechanisms, including keyboard shortcut blocking for debugging tools and execution time measurement to detect controlled environments.

Data exfiltration utilizes the same XOR technique with session-derived keys, while stolen credentials are transmitted to Russian-hosted servers through encoded POST requests containing both the encrypted data and decoding parameters.

IoC

Type	Subtype	IOC Value
Domain	–	innovationsteams[.]com
Domain	–	marketplace24ei[.]ru
Domain	–	nexttradeitaly[.]it[.]com
Domain	–	frankfurtwebs[.]com[.]de
URL	–	hxxps[://]telephony[.]nexttradeitaly[.]com/SSSuWBTmYwu/
URL	–	hxxps[://]parochially[.]frankfurtwebs[.]com[.]de/ps6VzZb/
URL	–	hxxps[://]marketplace24ei[.]ru//
URL	–	hxxps[://]marketplace24ei[.]ru/790628[.]php
IP Address	Email-extracted	153[.]127[.]234[.]4
IP Address	Email-extracted	51[.]89[.]33[.]171
IP Address	Email-extracted	191[.]96[.]207[.]129
IP Address	Email-extracted	153[.]127[.]234[.]5
Email	–	izumi [at] yurikamome[.]com

Stop social engineering attacks before they turn into breaches: Protect your team with ANY.RUN – Start your 14-day trial