Sneaky2FA is an adversary-in-the-middle (AiTM) phishing-as-a-service (PhaaS) kit targeting Microsoft 365 accounts, first detailed by Sekoia in January 2025 and active since at least October 2024. Operated by the "Sneaky Log" group and sold via a Telegram bot for around $200/month, it proxies authentication in real time to steal credentials and session cookies, bypassing MFA. Pages are typically hosted on compromised WordPress sites, pre-populate the victim's email, and use blurred Microsoft screenshots as backgrounds. Evasion includes Cloudflare Turnstile, CAPTCHA, IP filtering, and redirects of sandbox/analyst traffic to benign sites, plus heavy code obfuscation and rapid domain rotation. As of November 2025, the kit added Browser-in-the-Browser (BitB) pop-ups that spoof the Microsoft login window and address bar.