Sneaky2FA Phishing Kit Evolves with Browser-in-the-Browser Pop-ups Targeting Houston Businesses

A fake window, not a fake page - and that difference is the whole point.

A browser-in-the-browser attack draws a fake pop-up login window inside a web page using ordinary HTML and CSS, so the window that looks like a separate Microsoft sign-in prompt is actually a picture painted on the attacker's page. The researcher known as mr.d0x first documented the technique in March 2022.

Here is the sleight of hand. When a real site sends you to sign in with Microsoft, a genuine browser pop-up opens with a real address bar showing login.microsoftonline.com. The BitB attack recreates that pop-up in code. The title bar, the window controls, the padlock, the address bar text - all drawn on the page. Inside that fake frame sits an iframe pointed at the attacker's phishing server. You read a trusted URL, so you type. In 35 years doing this, the reliable advice was always "look at the address bar before you enter a password." This attack takes that advice and turns it into the trap.

• The window is fake, the URL text is fake. Both are HTML the attacker wrote, so the reassuring microsoftonline.com in the bar proves nothing.
• It adapts to your setup. Push Security found the kit renders different window styling for Windows Edge versus macOS Safari, so the fake matches what you expect to see.
• It does not need a software flaw. BitB abuses how single-sign-on pop-ups normally look. There is no patch for "it looks legitimate."

A staged lure that filters out security tools before the fake window ever appears.

The Sneaky2FA chain starts with a link to a legitimate-looking page, forces a Cloudflare Turnstile bot check to keep scanners out, shows a fake Adobe Acrobat document prompt, then springs the BitB Microsoft login window that harvests credentials and the session token together.

Every step is built to survive automated inspection. The Turnstile check and conditional loading screen out security crawlers and researchers; visitors who fail the profile get redirected to a harmless page like a Wikibooks article, so an analyst who pokes at the link sees nothing. Only a real, targeted victim reaches the fake window. Because a real reverse proxy sits behind that window, everything the victim types relays live to Microsoft, which means the attacker collects the authenticated session, not just a password.

• Step one, the lure. An email or message links to a domain dressed up as a document-preview or file-share service.
• Step two, the gate. A Cloudflare Turnstile bot check loads first, blocking automated security tools from ever seeing the payload.
• Step three, the bait page. A screen styled like Adobe Acrobat asks you to "Sign in with Microsoft" to view the file.
• Step four, the fake window. Clicking sign-in triggers the BitB pop-up with its fake Microsoft address bar.
• Step five, the theft. Your password, your MFA response, and your session token flow straight to the attacker for immediate account takeover.

The attacker is not guessing your code. They are stealing the door you already unlocked.

Sneaky2FA does not try to bypass the MFA prompt. It relays your real login to Microsoft through a reverse proxy, lets you complete MFA yourself, then steals the resulting session token. With a valid session in hand, the attacker is already inside, and no second factor is asked again.

This is the part that catches people off guard. Text-message codes, authenticator app approvals, even most one-time codes are all defeated the same way: you pass the check, and the attacker inherits the session behind it. Identity-based attacks are already the leading way businesses get breached, and this kit aims straight at that layer. The defenses that actually hold are the ones the attacker cannot relay - hardware security keys and passkeys built on the FIDO2 standard, which are bound to the real domain and simply refuse to authenticate to the fake window. Everything else on your list buys you detection time, not prevention.

• The session token is the prize. Once stolen, it is a valid pass that skips the login and the second factor entirely.
• Phishing-resistant beats phishable. FIDO2 security keys and passkeys are domain-bound, so they will not sign in to a look-alike window.
• Conditional access narrows the blast. Rules tied to device compliance and location can block a stolen session used from an unmanaged machine.
• Session monitoring catches the aftermath. Impossible-travel and anomalous-session alerts flag the takeover fast when prevention slips.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, and we build Microsoft 365 defenses around the assumption that a phishing link will eventually get clicked.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Against a kit that harvests session tokens and adapts its fake window to each victim, the answer is not a single tool - it is layered controls that make a stolen credential useless:

• Phishing-resistant authentication. We roll out FIDO2 security keys and passkeys that refuse to sign in to a look-alike domain, closing the door BitB relies on.
• Conditional access policies. Logins get checked against device compliance, location, and risk, so a session stolen to an unmanaged machine gets blocked.
• Live session and identity monitoring. Impossible-travel and anomalous-session alerts catch a takeover in minutes, not after the wire transfer.
• Awareness training built for this attack. We teach teams the one tell BitB cannot fake - a "pop-up" you cannot drag outside the browser window is not a real window.

If you run a business in Houston or Katy on Microsoft 365 - a law firm, a CPA practice, or an energy firm - and your MFA is still text codes or app approvals, you are exactly who this kit is built for. Talk to CinchOps and we will move you to a login an attacker cannot relay.