According to Barracuda on 15 October 2025, Whisper2FA is a phishing-as-a-service kit that steals Microsoft 365 passwords and live MFA responses through an AJAX real-time relay. Barracuda tracked the kit since July 2025 and saw close to a million Whisper2FA attacks in the month before publication, ranking it third among PhaaS kits after Tycoon and EvilProxy. Public reporting does not name specific victim organizations or attribute the operators.

The defining move is credential-phase: a spoofed Microsoft 365 login flow captures email and password, then relays OTP, SMS, voice, or push responses to attacker C2 until a live login succeeds. Session cookies after that success are residual, not a separate initial vector. A fix for this class of identity social engineering exists.

If you want the prevention angle, read the related article on mfa2point0.com.

FAQ

What is Whisper2FA and how did it harvest Microsoft 365 MFA?

Whisper2FA is the PhaaS kit Barracuda named on 15 October 2025 that harvests Microsoft 365 credentials and MFA tokens through a live AJAX relay. After the victim enters email and password on a fake login flow, the kit prompts for MFA, obfuscates the response, and posts it to attacker C2 for immediate validation against the real Microsoft sign-in. Failure re-prompts without a hard stop; success continues the attacker’s login. Barracuda described the design as a live relay that does not stop at a single stolen code and keeps going until the attacker successfully logs in.

Why did app OTP, SMS, voice, and push fail against Whisper2FA?

App OTP, SMS, voice, and push failed against Whisper2FA because those factors are transferable: the victim types or approves them on the attacker’s page, and the kit validates each response in real time. Barracuda noted the attacker server even supplies the MFA method list (push, SMS, voice, app OTP) and binds input fields so credentials leave on Enter or submit. The kit does not need to break cryptography. It only needs a phishable second factor completed on the wrong origin. Public reporting does not establish that every enterprise MFA method was in scope beyond those phishable login factors.

Were stolen session cookies the initial Whisper2FA vector?

Stolen session cookies were not the initial Whisper2FA vector. Barracuda’s chain shows the kit first completing a phished Microsoft 365 authentication via live MFA relay; cookies and other post-auth session material appear only after that login succeeds. That makes session theft a residual outcome of the credential-phase win. No MFA prompt undoes a session already issued. Closing the phishable login stops this path. Malware after a legitimate login is a harder, separate problem.

How large was the Whisper2FA campaign Barracuda reported?

Barracuda reported close to a million Whisper2FA attacks in the month before the 15 October 2025 Threat Spotlight, with tracking since July 2025 on the order of about a million attacks overall, and ranked Whisper2FA third after Tycoon and EvilProxy. The campaigns hit Microsoft 365 accounts across large phishing waves and multiple sectors. Public reporting does not establish confirmed account-compromise counts distinct from that attack volume, ransom activity, or named tenant victims.

Is Whisper2FA the same kit as EvilProxy or Salty 2FA?

Whisper2FA is not the same kit as EvilProxy or Salty 2FA. Barracuda contrasts Whisper2FA’s lightweight AJAX exfiltration and aggressive anti-analysis with EvilProxy’s heavier reverse-proxy style, and treats Salty 2FA as an adjacent Microsoft 365 credential-harvesting PhaaS with similar obfuscation themes. Public reporting does not establish shared operators between Whisper2FA and Salty 2FA.