Oct 1

October PhishQueue Phishing News

“Whisper 2FA proves it: Verification alone won’t save you, but PhishQueue will.”

New Whisper 2FA Phishing Kit Targets Microsoft 365 Accounts

The Growing Threat

What’s Going On?

A new phishing toolkit called Whisper 2FA is being used to break into Microsoft 365 accounts. It does not just steal your password; it also captures your multi-factor authentication (MFA) codes in real time, which means even if you use MFA, attackers may still get in.

This phishing kit is widely available, easy for attackers to use, and effective at bypassing protections many users rely on.

How It Works:

You receive an email impersonating from Microsoft, Docusign, a voicemail system, or another familiar service.
You click the link and see a login screen that looks just like Microsoft 365.
You enter your password and your MFA code.
The phishing toolkit captures everything in real time, giving attackers immediate access to your account, even if MFA is enabled.

Why It Is Dangerous:

It is effective even if you use MFA.
The fake login screens are highly convincing and closely mimic real Microsoft 365 pages.
Attackers may try multiple times until they capture a valid MFA code.
You may not realize your account has been compromised until the damage has already occurred.

Sources: Nearly a Million Microsoft 365 Accounts Targeted by New Whisper 2FA Phishing Kit

🛡️ Your Best Defense: Do Not Click it. Submit It.

If something seems off; a strange sender, an unexpected login screen, or even a legit-looking email with a login link, report it to PhishQueue before you do anything else.

📌 Remember: The smartest move? Use PhishQueue first, not your best guess.

_____________________________________

🤖 Massive Microsoft 365 Phishing Attacks Using Whisper 2FA Kit

🔍 Example: A global malware campaign is using fake CAPTCHA pages to trick users into installing the Lumma information stealer, targeting industries like telecom, banking, and healthcare.

By convincing victims to run malicious commands outside the browser, attackers bypass security measures and evade detection. The campaign is part of a growing trend of sophisticated phishing tactics using fake domains, compromised emails, and platforms like Gravatar to mimic trusted services and steal credentials.