InfoSecBulletin Cybersecurity for mankind
The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses a reverse proxy, captures credentials in real-time, and hijacks sessions.
The new phishing kit called Astaroth has been found on cybercrime networks by SlashNext threat researchers. Astaroth can bypass two-factor authentication (2FA) by using session hijacking and real-time credential interception, according Hackread.com.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Astaroth stands out from typical phishing kits due to its real-time interception ability. While traditional kits only capture login credentials and struggle with 2FA-protected accounts, Astaroth intercepts and forwards tokens immediately, allowing attackers to access accounts right after authentication.
“Attackers now use man-in-the-middle reverse proxies to mimic legitimate sites, capturing usernames, passwords, 2FA tokens and session cookies instantly,” explained Jason Soroko, a senior fellow at Sectigo. “This method hijacks authenticated sessions before security can react, rendering 2FA ineffective.”
The attack starts when victims click a phishing link that directs them to a malicious server functioning as a reverse proxy.
With SSL certificates in place, victims perceive no security threats. After entering credentials and tokens, Astaroth collects the information and notifies attackers through Telegram or a web panel.
“The availability of kits like Astaroth lowers the barrier to entry for cybercriminals, empowering less-experienced attackers to execute highly effective attacks,” said Patrick Tiquet, vice president of security & architecture at Keeper Security.
“By leveraging real-time credential interception and reverse proxies to hijack authenticated sessions, attackers can bypass even the strongest phishing defenses – including multi-factor authentication (MFA).”
The final phase uses captured session cookies to mimic the victim’s login, bypassing 2FA since the session is already authenticated.
“This phishing kit shows an alarming amount of sophistication,” warned Thomas Richards, principal consultant at Black Duck. “All the usual defenses and things to look out for that we train users on are harder to spot with this attack.”
