Abnormal has identified a Microsoft 365 Adversary-in-the-Middle (AiTM) phishing platform it calls Matrix, and placed it within the lineage of Sneaky2FA, the Phishing-as-a-Service (PaaS) operation disrupted by German and US law enforcement in July.
The name has not appeared in prior public reporting, but the code has. Five operator images served by the Matrix panel were byte-identical to files from a Kratos deployment Abnormal captured in July, and the panel login script shared 37 of roughly 82 lines verbatim with a Kratos panel captured in June.
Abnormal noted the limits of that evidence. The shared files indicated a common builder, rather than a common operator, and did not connect this deployment to the infrastructure taken down last month.
The Link Never Appears in the Email
The lure was an unremarkable OneDrive notification. Its delivery mechanism was more notable: the message arrived from a genuine, compromised Microsoft 365 mailbox at an unrelated organization, so SPF and DKIM passed and it landed cleanly.
The operator URL was not in the message body. It sat inside a nested message/rfc822 attachment, which Abnormal called the campaign’s “most important defensive gap,” because the link never appears in the fields a mail gateway or URL scanner reads.
Clicks then passed through two abused but legitimate SaaS services (QuestionStar and Zoho Insights), before hitting a cloaking page that fed scanners a decoy while passing real browsers to the harvester. Abnormal recommended hunting specific paths through these services, rather than blocking them outright.
What waited there was not a static credential form. Abnormal found six separate indicators in the client code showing the backend held a live authenticated session with Microsoft while the target typed.
After the password step it returned the account’s registered MFA methods and showed only those, displayed live Authenticator number-match digits, and pulled the organization’s Entra branding.
A Franchise That Outlives Its Brand
The kit stylesheet and operator images recurred across a cluster of phishing hosts spanning multiple providers and brand names.
Public reporting put the Sneaky2FA-lineage service at roughly 1,800 franchisees running 15,000 campaigns a month before the takedown, and Matrix appeared to be one branded deployment among several.
Because the stolen artifact was a live MFA-satisfied session, a password reset did not invalidate it.
Abnormal recommended revoking Entra refresh tokens and sessions and re-enrolling MFA for anyone who reached the harvester, and treating authenticated mail carrying a nested attachment that renders as a document notice as a detection signal in its own right.
