INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Google AitM Phishing Kit Exploits WebSockets to Bypass MFA

| 2026-10-12 13:55 CRITICAL HIGH PHISHING & SOCIAL ENGINEERING CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
A Google account phishing kit, known as Tycoon2FA, has been discovered using live WebSocket connections to bypass multi-factor authentication (MFA) in real time. The operation targets individuals linked to research organizations and uses fake sign-in screens to relay authentication requests and steal authenticated sessions. According to Talos Intelligence, the campaign shows how attackers can get past MFA by forwarding login steps in real-time rather than breaking security checks themselves. This phishing kit is part of a broader trend where modern phishing kits intercept live sessions, bypassing most forms of MFA.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 5 IoCs Create Free Account
go•••••.com
go•••••.com
jm•••••.com
ac•••••.com
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
APT29APT29
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎late 2024
Attackers have been tricking ClickFix users into copying and executing malicious commands under the pretext of "fixing" a fake CAPTCHA or verification challenge since late 2024.
organisation ClickFix
Malicious copy and paste (ClickFix) Since late 2024, attackers have been tricking users into copying and executing malicious commands under the pretext of "fixing" an issue — most commonly a fake CAPTCHA or verification challenge.
organisation CAPTCHA
Malicious copy and paste (ClickFix) Since late 2024, attackers have been tricking users into copying and executing malicious commands under the pretext of "fixing" an issue — most commonly a fake CAPTCHA or verification challenge.
‎Q2 2026
ClickFix became the dominant technique in Push detections for the first time, reaching 52% of total detections in Q2 2026.
general_metric 52 %
ClickFix became the dominant technique in Push detections for the first time in Q2 2026, reaching 52% of total detections.
‎2026/09/30
Threat actors used a Google AI-powered phishing kit that leverages WebSockets to bypass multi-factor authentication (MFA) in real-time during browser sessions.
‎2026/10/12
Google's AitM Phishing Kit exploits live WebSocket connections to bypass MFA in real-time, allowing attackers to steal authenticated sessions.
organisation WebSockets
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time.
organisation Bypass MFA
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time.
organisation Google
A Google account phishing kit uses live WebSocket connections to guide victims through fake sign-in screens, relay authentication requests, and steal authenticated sessions.
organisation WebSocket
A Google account phishing kit uses live WebSocket connections to guide victims through fake sign-in screens, relay authentication requests, and steal authenticated sessions.
organisation Cyber Security News
Phishing Kit Uses WebSockets to Bypass MFA in Real Time appeared first on Cyber Security News .
organisation SMS
At the same time, phishing delivery has moved well beyond email — attackers deliver links over instant messaging, social media, SMS, malicious ads, and in-app messaging.
organisation Modern
1. Phishing for credentials and sessions Modern phishing kits don't just steal passwords — they intercept live sessions.
data_breach 1 data
According to Push data, roughly 1 in every 2 phishing attacks is delivered outside of email entirely.
organisation OAuth
Consent phishing sees the victim authorize a malicious third-party app via an OAuth consent grant.
infrastructure 8628 device authorization grant
Device code phishing abuses the RFC 8628 device authorization grant to circumvent standard authentication entirely — Push now tracks 30+ distinct kits offering the technique.
organisation MFA
The campaign shows how attackers can get past MFA by forwarding login steps in real time rather than breaking the security checks themselves.
Reverse-proxy adversary-in-the-middle (AiTM) kits like Tycoon2FA, Sneaky2FA, and Evilginx relay credentials and session tokens in real time, bypassing most forms of MFA.
organisation AiTM
Reverse-proxy adversary-in-the-middle (AiTM) kits like Tycoon2FA, Sneaky2FA, and Evilginx relay credentials and session tokens in real time, bypassing most forms of MFA.
organisation ConsentFix
ConsentFix is a ClickFix-OAuth hybrid first observed in Russian APT29 campaigns that has since been commoditized into criminal tooling .
threat_actor APT29
ConsentFix is a ClickFix-OAuth hybrid first observed in Russian APT29 campaigns that has since been commoditized into criminal tooling .
organisation Microsoft
Microsoft's Digital Defense Report identified ClickFix as the most common initial access vector, accounting for 47% of observed attacks.
organisation Digital Defense Report
Microsoft's Digital Defense Report identified ClickFix as the most common initial access vector, accounting for 47% of observed attacks.
organisation the Verizon DBIR 2026
AI browser extensions add a further dimension — the Verizon DBIR 2026 found that more than 15% of corporate users had unauthorized AI browser extensions installed, and Push found an average of 17 unique AI extensions per company (with one team running 163), creating data exfiltration pathways independent of traditional DLP controls.
organisation Password
Credential stuffing and ghost logins Password-based compromise remains one of the leading causes of breaches, which might surprise you if you think SSO solved credential attacks.
organisation SEO
Four in five ClickFix payloads intercepted by Push are accessed from search engines via compromised sites, malvertising, and SEO poisoning, completely bypassing email security.
organisation InstallFix
InstallFix uses malvertised fake install pages for developer tools like Claude Code and NotebookLM, where the install command has been replaced with a malicious one.
organisation SSO
But SSO isn't universal — SAML often costs extra, self-adopted apps rarely get configured, and most apps allow simultaneous login methods.
organisation IdP
The result is ghost logins : backup credentials outside SSO, invisible to IdP logs, created at adoption and still active unless explicitly disabled.
organisation Cloudflare
Cloudflare's 2026 Threat Report found that 63% of all human logins involve credentials already compromised elsewhere.
organisation The Verizon DBIR 2025
The Verizon DBIR 2025 found that 46% of infostealer infections leading to corporate breaches originate on non-managed devices — personal machines, developer workstations, and contractor laptops where EDR is absent.
organisation EDR
The Verizon DBIR 2025 found that 46% of infostealer infections leading to corporate breaches originate on non-managed devices — personal machines, developer workstations, and contractor laptops where EDR is absent.
organisation Push Security
For more detail on each of these attack techniques, how they work in the wild, and what you can do about them, check out the guide to 2026 Browser Attack Techniques from Push Security .
Tactical Metrics
Metrics
data_breach
1
Data
According to Push data, roughly 1 in every 2 phishing attacks is delivered outside of email entirely.
Metrics
infrastructure
8,628
Device Authorization Grant
Device code phishing abuses the RFC 8628 device authorization grant to circumvent standard authentication entirely — Push now tracks 30+ distinct kits offering the technique.
Intelligence Sources
AlienVault OTX 2026-10-12
The Hacker News 2026-09-30