PHISHING Possible Sneaky2FA Browser-in-the-Browser (BITB) Page

Tim Peck@timpeck

•updated Dec 1, 2025•4•2•183

This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.