Thursday , March 27 2025
Astaroth

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses a reverse proxy, captures credentials in real-time, and hijacks sessions.

The new phishing kit called Astaroth has been found on cybercrime networks by SlashNext threat researchers. Astaroth can bypass two-factor authentication (2FA) by using session hijacking and real-time credential interception, according Hackread.com.

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

VMware Patches Authentication Bypass Flaw in Windows Tool

On Tuesday, VMware issued an urgent fix for a security flaw in its VMware Tools for Windows. CVE-2025-22230 allows a...
Read More
VMware Patches Authentication Bypass Flaw in Windows Tool

IngressNightmare
Over 40% of cloud environments are vulnerable to RCE

Kubernetes users of the Ingress NGINX Controller are advised to fix four newly found remote code execution ( RCE) vulnerabilities,...
Read More
IngressNightmare  Over 40% of cloud environments are vulnerable to RCE

(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass

Next.js, a widely used React framework for building full-stack web applications, has fixed a serious security vulnerability. Used by many...
Read More
(CVE-2025-29927)  Urgently Patch Your Next.js for Authorization Bypass

Oracle refutes breach after hacker claims 6 million data theft

A hacker known as “rose87168” claims to have stolen six million records from Oracle Cloud servers. The stolen data includes...
Read More
Oracle refutes breach after hacker claims 6 million data theft

Russian zero-day seller to offer up to $4 million for Telegram exploits

Operation Zero, a Russian zero-day broker, is offering up to $4 million for Telegram exploits. They seek $500K for one-click...
Read More
Russian zero-day seller to offer up to $4 million for Telegram exploits

Astaroth stands out from typical phishing kits due to its real-time interception ability. While traditional kits only capture login credentials and struggle with 2FA-protected accounts, Astaroth intercepts and forwards tokens immediately, allowing attackers to access accounts right after authentication.

“Attackers now use man-in-the-middle reverse proxies to mimic legitimate sites, capturing usernames, passwords, 2FA tokens and session cookies instantly,” explained Jason Soroko, a senior fellow at Sectigo. “This method hijacks authenticated sessions before security can react, rendering 2FA ineffective.”

The attack starts when victims click a phishing link that directs them to a malicious server functioning as a reverse proxy.

With SSL certificates in place, victims perceive no security threats. After entering credentials and tokens, Astaroth collects the information and notifies attackers through Telegram or a web panel.

“The availability of kits like Astaroth lowers the barrier to entry for cybercriminals, empowering less-experienced attackers to execute highly effective attacks,” said Patrick Tiquet, vice president of security & architecture at Keeper Security.

“By leveraging real-time credential interception and reverse proxies to hijack authenticated sessions, attackers can bypass even the strongest phishing defenses – including multi-factor authentication (MFA).”

The final phase uses captured session cookies to mimic the victim’s login, bypassing 2FA since the session is already authenticated.

“This phishing kit shows an alarming amount of sophistication,” warned Thomas Richards, principal consultant at Black Duck. “All the usual defenses and things to look out for that we train users on are harder to spot with this attack.”

Check Also

VMware

VMware Patches Authentication Bypass Flaw in Windows Tool

On Tuesday, VMware issued an urgent fix for a security flaw in its VMware Tools …

Leave a Reply

Your email address will not be published. Required fields are marked *