Hackers have developed a phishing kit capable of bypassing two-factor authentication systems, previously considered to be one of the most secure ways of protecting access to online accounts.
Two-factor authentication, which involves providing additional information (usually a code sent by email or SMS) in addition to a traditional password to log into an online service, is a recommended security measure to protect access to your most sensitive accounts. Unfortunately, this solution, which seemed to be an invincible barrier against hackers, is now being undermined by a phishing tool called Astaroth, named after the Great Duke of Hell.
Cybersecurity specialist SlashNext was the first to spot this new tool, capable of bypassing two-factor authentication on Google, Microsoft and Yahoo accounts. To achieve this, the hackers send a fraudulent link to users, directing them to a fake login page perfectly imitating the real interface of the targeted platform. When users enter their login details and secret code, this information is immediately captured and misappropriated by the cybercriminals.
What makes Astaroth particularly dangerous is its ability to intercept two-factor authentication codes in real time. According to SlashNext, the complete kit is sold on the Dark Web for US$2,000 (RM8,855).
To protect yourself against this type of attack, you should, as always, be highly vigilant and avoid clicking on suspicious links from unknown senders. It's also advisable to use other, even more secure authentication methods, such as passkeys, which allow you to log in without a password, using a fingerprint, facial recognition or a code stored on the device. This is possible with Apple, Google and Microsoft. – AFP Relaxnews
