Attacks with Whisper 2FA PhaaS kit escalate, report finds

Almost a million phishing intrusions have been fueled by the Whisper 2FA phishing-as-a-service kit since July, making it the third most prevalent PhaaS kit after Tycoon and EvilProxy, according to Infosecurity Magazine.

Multiple brands, including Microsoft 365, Adobe, and DocuSign, have been spoofed in phishing emails spreading Whisper 2FA, which harnesses the AJAX web technology to enable persistent credential and multi-factor authentication code capturing before conducting real-time code validation, a report from Barracuda revealed.

Additional findings showed Whisper 2FA's newest versions to integrate dense Base64 and XOR encoding layers, various anti-debugging capabilities, readable text removal, and browser freezing in the event of developer analysis of the phishing page.

"The Whisper 2FA phishing campaign demonstrates how phishing kits have evolved from simple credential stealers into sophisticated, full-service attack platforms... This level of sophistication reflects the rise of Phishing-as-a-Service (PhaaS), where kits are professionally developed, regularly updated and sold or leased to attackers," said Barracuda.