Turning on multi-factor authentication used to be the answer to phishing. A stolen password was useless without the second code, and for years that was enough to stop most account takeovers. The phishing kits sold on criminal marketplaces in 2026 were built to get around it, and the most active ones now defeat MFA as a matter of routine. Healthcare is among one of the most popular sectors they target.

A phishing kit is a prewritten package of code that lets a criminal with almost no technical skill run a convincing phishing campaign. The modern versions are sold as a subscription, a model the industry calls phishing-as-a-service (PhaaS), where the developer maintains the tooling and rents it out through Telegram channels for a monthly fee, complete with customer support and regular updates. According to Cybersecurity News, several new kits are becoming frequently used by cybercriminals to launch attacks.

 

The two techniques that defeat MFA

Almost every high-volume kit in circulation relies on one of two methods, and the difference matters because each calls for a different defense.

The first is an adversary-in-the-middle attack, usually shortened to AiTM. The kit sets up a reverse proxy, a server that sits invisibly between the victim and the real Microsoft login page, passing traffic back and forth so the victim sees a genuine-looking sign-in and completes their MFA challenge normally. The proxy quietly captures the session cookie Microsoft issues afterward, the small file a browser holds onto so a user does not have to log in again on every click. With that cookie, the attacker walks into the account without ever needing the password or the second factor.

The second method abuses the OAuth device-code flow. OAuth is the standard that lets one app access another without sharing a password, and the device-code version exists so hard-to-type devices like smart TVs and printers can sign in by having you enter a short code on your phone. Attackers weaponize that convenience. They trigger a real device-code request from Microsoft, then send the victim a lure presenting the code as a document-access or verification step, asking them to enter it at the genuine microsoft.com/devicelogin page. The victim authorizes what they think is their own login and hands the attacker's device a fully authenticated session instead.

 

Rising phishing kits

Sneaky2FA

Sneaky2FA is an AiTM kit sold through Telegram and built to compromise Microsoft 365 accounts. Researchers who tracked it found that it validates stolen credentials in real time against Microsoft's own systems and uses blurred screenshots of real Microsoft pages as decoy backgrounds to make its fake login windows convincing. It stays near the top of activity trackers month after month, which makes it one of the kits a healthcare security team is most likely to encounter in the wild.

 

Tycoon2FA

Tycoon2FA was the dominant AiTM platform for most of 2025 before an international takedown led by Microsoft and Europol disrupted its infrastructure in March 2026. It did not stay down. As BleepingComputer reported, the operators rebuilt on new infrastructure within weeks and, by late April, had added device-code phishing to the kit. The evolution shows the two MFA-defeating techniques converging inside a single piece of tooling rather than staying separate.

 

Evilginx2 and EvilProxy

Evilginx2 began life as an open-source tool for legitimate security testing before criminals adopted it, and EvilProxy is the commercialized version sold on dark web forums for a few hundred dollars a month. Both are reverse-proxy AiTM kits that intercept live traffic between a victim and real identity providers, including Microsoft 365, Google Workspace, and Okta, to steal the session cookie after MFA is complete. Their long presence and low cost have made the reverse-proxy technique a standard part of the criminal toolkit rather than a novelty.

 

EvilTokens

EvilTokens is one of the kits that turned device-code phishing into an off-the-shelf product. It appeared in early 2026 and sells the OAuth abuse technique on a subscription basis, bundling token harvesting, reconnaissance, and lure generation into a single service. A device-code campaign tracked across early 2026 reached more than 340 organizations across construction, real estate, manufacturing, financial services, healthcare, legal, and government, showing how fast the technique spread once it was packaged for sale.

 

Kali365

Kali365 surfaced in April 2026 and became the subject of an FBI advisory shortly after. It steals Microsoft 365 access tokens through device-code phishing, bypassing the password and MFA prompt entirely by getting the victim to approve what looks like a document-share or Teams-invite code on a genuine Microsoft URL. Reporting on 2026 kit activity noted it is sold on a straightforward subscription, roughly $250 a month or $2,000 a year, pricing that puts a working device-code attack within reach of almost anyone.

 

Greatness

Greatness is the kit with the longest healthcare track record. Active since mid-2022 and detailed by researchers the following year, it does one thing and does it convincingly, cloning Microsoft 365 login pages while automatically pulling in a target company's real logo and background and pre-filling the victim's email address so the fake page looks like their own. Its campaigns have concentrated on manufacturing, healthcare, and technology firms across the US, UK, Australia, South Africa, and Canada, with healthcare in its top three target sectors from the start.

 

Kratos

Kratos shows both what disruption can achieve and where it falls short. German and US law enforcement dismantled it in July 2026, seizing more than 200 servers and arresting its alleged developer, with investigators estimating 1,800 paying customers had run roughly 15,000 campaigns a month through it. Residual activity persisted afterward because the kit's code was already in criminal hands, a reminder that seizing infrastructure does not recall software that has already been distributed.

Read more: What is a phishing attack? | Phishing kits fuel service-based cybercriminals

 

Why healthcare sits in the crosshairs

Healthcare runs on Microsoft 365 and Google Workspace the same way every other sector does, but the conditions around that email make it a softer target. Clinical and administrative staff process a constant stream of legitimate messages about referrals, lab results, insurance claims, and shared documents, which is the exact disguise these kits use. A device-code lure framed as a SharePoint access request or a DocuSign notification does not look out of place in a hospital inbox.

The Verizon 2026 Data Breach Investigations Report found phishing remained one of the leading paths into confirmed breaches, and healthcare has been the most targeted critical infrastructure sector in the US for two consecutive years. The reporting gap makes it worse. Paubox's 2025 Healthcare Email Security Report found that employees report only 5% of known phishing attempts to their security teams, which means the lure that starts an account takeover almost always reaches its target unflagged.

 

What actually stops these kits

Standard MFA, the SMS code or the push notification, no longer stops the kits built to beat it. The defenses that hold up work at a different level.

Phishing-resistant MFA is the strongest single control. Standards like FIDO2 and passkeys, which are login methods that cryptographically tie a sign-in to the real website's address, cannot be relayed through an attacker's proxy, because the authentication fails when the address is wrong. An AiTM kit that intercepts everything else has nothing to steal. For the device-code technique, restricting or disabling the OAuth device-code flow in Microsoft Entra ID, the identity system behind Microsoft 365, closes that door for organizations that do not genuinely need it.

Those controls live in the identity layer, and they still assume the lure reaches the inbox. Stopping it earlier removes the interaction every one of these kits depends on. Paubox's 2026 Healthcare Email Security Report tracked a 47% increase in attacks avoiding native email defenses in 2025, which tells you the filtering built into Microsoft 365 and Google Workspace is not catching what these campaigns send. Paubox Inbound Email Security uses AI to analyze sender behavior, message intent, and contextual signals rather than matching known-bad content, which is the approach that catches a lure pointing to a legitimate Microsoft URL before a staff member ever sees it.

Learn more: Paubox Inbound Email Security

 

FAQs

Why doesn't MFA stop these phishing kits anymore?

The kits work around it rather than through it. Adversary-in-the-middle kits let the victim complete MFA normally and then steal the resulting session cookie, while device-code kits trick the victim into authorizing the attacker's device on a real Microsoft page. In both cases, the password and second factor stay intact, and the attacker still gets in.

 

What is OAuth device-code phishing?

It abuses a legitimate feature that lets hard-to-type devices sign in by having a user enter a short code elsewhere. An attacker triggers a real code request from Microsoft, then sends a lure asking the victim to enter that code as a verification step. Entering it authorizes the attacker's device, and standard MFA offers no protection because the victim completes it themselves.

 

Is healthcare specifically targeted by these kits?

Yes. The Greatness kit has listed healthcare among its top three target sectors since 2022, and a large device-code campaign tracked in early 2026 named healthcare among the sectors it hit. Heavy reliance on Microsoft 365 and a high volume of legitimate document and claims email make healthcare inboxes a natural fit for these lures.

 

Do law enforcement takedowns actually stop the kits?

They help but rarely end the threat. Tycoon2FA was disrupted by Microsoft and Europol in March 2026 and rebuilt within weeks, and the Kratos takedown in July 2026 still left residual activity because the kit's code was already distributed. Seizing servers does not recall software criminals already hold.

 

What is the most effective defense a healthcare organization can deploy?

Phishing-resistant MFA such as FIDO2 or passkeys is the strongest control, since it cannot be relayed through an attacker's proxy, and restricting the OAuth device-code flow closes the other major path. Pairing those identity controls with pre-delivery email filtering that removes the lure before staff interact with it addresses the problem at both the entry point and the authorization step.