ASTAROTH PHISHING KIT BYPASSES 2FA TO HIJACK GMAIL AND MICROSOFT ACCOUNTS

Summary from the TLDR InfoSec newsletter

A new phishing kit called Astaroth can bypass two-factor authentication to steal login credentials from Gmail, Yahoo, and Microsoft accounts. Astaroth utilizes an evilnginx-style proxy to Man In The Middle user sessions to intercept authentication data, making it difficult for users to detect the attack. The sophisticated kit is sold on cybercrime networks for $2,000 and includes custom hosting options to evade detection.