Why This Matters Now

Reverse-proxy phishing kits arrived in earnest in 2022 and matured into a subscription-style market across 2024 and 2025. The shift mattered because it broke the pattern that defenders had relied on for a decade: that credential phishing pages were static clones of identity-provider login screens, distinguishable by URL inspection or visual hash. A reverse-proxy kit relays the real provider page to the victim and the real victim back to the provider, completing the multi-factor exchange and harvesting the issued session token. The lure is no longer the artifact. The kit is.

By 2026, the kit ecosystem looks less like a malware family and more like SaaS. Operators rent access. Authors maintain infrastructure rotation, captcha-bypass refreshes, and victim-targeting features. Because the operator is detached from the kit author, attribution fragments — the same kit appears across financially motivated, espionage-adjacent, and opportunistic activity within the same week.

Shape of the Trend

The kit families that dominate public reporting are Tycoon 2FA (operated by the cluster Microsoft tracks as Storm-1747), EvilProxy (covered consistently by Proofpoint after Resecurity's original 2022 disclosure), Mamba 2FA (documented by Sekoia in 2024), and Greatness (originally written up by Cisco Talos in 2023 and tracked across vendors since). They share a common architecture — reverse-proxy front, victim-specific URL paths, captcha gating to deter automated takedown — and differ primarily in lure customization, pricing tier, and which identity providers they target.

Tycoon 2FA is the most-discussed of the group across 2024 and 2025 vendor reporting. Sekoia has published several deep dives into its URL-path schema and JavaScript bundle structure. Microsoft has tied an operator cluster to its sale and operation. EvilProxy has held a more enterprise-targeting posture per Proofpoint's coverage. Mamba 2FA appeared as an active competitor in mid-2024 per Sekoia. Greatness has remained associated with Microsoft 365 credential theft across the same period.

Timeline 2024 → 2026

Public reporting documents a steady arrival rather than discrete events. EvilProxy was the public-facing leader through 2023. Tycoon 2FA scaled significantly across 2024 in Sekoia and Microsoft tracking. Mamba 2FA appeared in Sekoia's reporting as an active competitor in the same window. Through 2025 and into 2026, the kit population diversified rather than consolidated; operators move between kits as features and prices change.

TTPs in Detail

The reverse-proxy mechanic is consistent. The victim arrives at an attacker-controlled domain that mirrors the identity-provider login page byte-for-byte because it is, in fact, that page — proxied. Credentials submitted by the victim are forwarded to the provider; the multi-factor challenge issued by the provider is forwarded back to the victim; the victim's response goes through the proxy; and the session cookie issued at the end of the exchange is captured by the proxy before being passed on. The attacker leaves with a valid session, often with refresh-token-class durability when the victim authorizes a long-lived consent.

Kit operators commonly target first-party Microsoft client identifiers because those clients inherit broad default scopes on Microsoft Graph and Exchange Online. The same pattern applies to Google Workspace targeting where reported. Lure delivery uses email, SMS, Microsoft Teams external chat, and abused trusted infrastructure depending on the customer.

What Worked, What Didn't

The technique succeeded against environments that relied primarily on URL inspection, brand training, and SMS-based MFA. It also succeeded broadly against TOTP and push-based MFA when the victim completed the prompt during the live session. The technique did not succeed where the second factor was phishing-resistant — FIDO2 security keys and platform passkeys complete authentication against the legitimate provider's origin only, and a reverse proxy at a different origin cannot satisfy the challenge. Conditional Access policies that require compliant or hybrid-joined devices on sensitive applications also broke the chain after token theft, because the captured token was not bound to a registered device.

What stopped working from the operator side is more interesting. URL-similarity blocklists were never very effective against well-resourced kits, which rotate domains daily. But across 2024 and 2025, public reporting suggests defenders had increased success matching kits at the JavaScript-bundle and URL-path layer, surviving infrastructure rotation. Operators responded by introducing per-customer bundle randomization, with mixed results.

The 2026 Entrants: Device Code Joins the Kit Stack

The kits that arrived across the first half of 2026 mark a shift in what "kit" means. The earlier generation sold a reverse proxy. The newer generation sells an operation: reverse-proxy AitM bundled with device-code phishing, AI-assisted lure generation, and post-compromise mailbox automation, all under a subscription.

Kali365, the subject of an FBI IC3 public service announcement on May 21, 2026, was first seen in April and distributed via Telegram. It lets less-technical operators obtain Microsoft 365 access tokens and bypass MFA without intercepting the victim's password — the device-code and token-theft model rather than the credential-harvest model. EvilTokens, documented by Huntress in early 2026, is a turnkey device-code phishing platform with AI baked into lure creation, part of a broader surge that saw device-code phishing detections rise sharply between late 2025 and early 2026.

Two July 2026 disclosures from ZeroBEC extend the pattern. DEBULL pushes users into the legitimate Microsoft device-login experience while a backend broker generates and polls Microsoft Authentication Broker device-code tokens, then hands the operator a GraphSpy or GraphSpy-derived workflow for Microsoft 365 and Entra post-exploitation; one campaign used a compromised Croatian rental website as the device-code orchestrator, and the activity overlaps strongly with the Storm-2372 tradecraft Microsoft documented in February 2025. Forg365, at $400 a month or $3,800 a year over Telegram, combines device-code phishing, AitM token and cookie handling, AI-drafted mailbox responses, and a ForgCookie browser extension that performs automatic SSO cookie refresh for Microsoft services — abusing Amazon SES and Twilio SendGrid for delivery and tracking. It sits in the same lineage as Kali365, Octopi365, Freedom365, and Sneaky 2FA.

The common thread is that attribution fragments further and the artifact set widens. A single kit now leaves reverse-proxy fingerprints, device-code flow telemetry, and post-compromise Graph API behavior, and the same tooling appears under many unrelated operators. The reusability cuts across providers too: the `input_24` / PoisonSeed reverse-proxy chassis that these Microsoft-focused kits share design DNA with has already been retooled against AWS console sign-in in a June 2026 wave.

Where It's Heading

Public reporting through mid-2026 indicates the kit market is fragmenting rather than consolidating. New kits appear; older kits split or rebrand; and the newest ones fold device-code phishing and post-compromise automation into what used to be a bare reverse proxy. The defender posture that survives this trend treats kits as a class rather than chasing instances: phishing-resistant authentication on identity-critical accounts, Conditional Access on session lifetime and device posture, restriction of the device-code authentication flow where business processes allow, and detection that operates at the kit-fingerprint, device-code-flow, and identity-provider-telemetry layers rather than the lure layer.