RedLogin

RedLogin is an MFA bypass phishing kit that targets Microsoft 365 accounts.

Push's research into the history of this kit suggests that it's a resurgence of a tool that was originally seen in 2023, or based on the past tool. A significant phishing campaign using IPFS hosting was uncovered through analysis of past urlscan results. The tool appeared to go inactive until its reappearance in 2025.

URL patterns

• Typically hosted on a random 10-character lowercase subdomain on a throwaway, low-reputation registered domain - for example, e6qjwfqo90.conotegway.xyz, v8xux8mxjh.boardvaultrec.com, bo6ntcc4ck.heartless-knight.com, vilhoyzw9m.jaxongadget.com, oz25ssuqdu.inseteadii.pics, kuwkdisq9v.fiazahforla.com).
• After passing the anti-bot gate, the phishing page is served from a path constructed from a long selection of random words joined by underscores - for example, /deer9_apple4_table9_cat9_table10_road3_galaxy6_... or /aura_breeze_unicorn_mango_date_limestone_vanguard_seaweed_....
  • Before March 2026, the URL path was /m/<TOKEN> where <TOKEN> was a 50-character uppercase alphanumeric string.
• The victim's email is frequently passed in a URL parameter: ?email=<addr> or ?e=<addr>.

Anti-bot gate

The first variants of RedLogin that Push detected in late 2025 used a direct copy of the anti-bot gate associated with Sneaky 2FA. However, given that this was a static copy of a Sneaky 2FA anti-bot gate, certain distinctive paths were not randomised: /6aa533c9daf2a71d/images/favicon.ico.

An alternative custom gate based on a simple JavaScript loading bar below a pulsing Microsoft logo was introduced in March 2026. There were no real browser fingerprinting or anti-bot detections involved. This landing page contained a typo of the word "accessing" in its HTML obfuscated text content.

Clone of the Sneaky 2FA turnstile

Custom loading gate with typo

Network traffic

Controller script

After passing the anti-bot gate, the initial phishing page HTML is minimal; it has an empty body and simply loads required scripts and resources. The primary obfuscated script is loaded from a path with the following patterns:

• /m/aty/<TOKEN> where <TOKEN> is a 25-character uppercase alphanumeric string (2025 through mid-March 2026).
• /a/<TOKEN> where <TOKEN> is a 25-character uppercase alphanumeric string
  • In July 2026, a 25-character lowercase string of letters was observed

This script implements the core activities of the phishing kit, including retrieving HTML templates for display, relaying credentials, and establishing WebSocket C2.

Credential relay

Form encoded POST requests are made to a path matching the pattern /m/sc/<TOKEN>. The <TOKEN> has typically been a 25-charcter uppercase alphanumeric string. In July 2026, a 25-character lowercase string of letters was observed. The target path is extracted extracted from configuration embedded in the page:

• Early 2026, from the mpull variable in a <script> element in the document <head>.
• From mid-March 2026, from the b attribute on the <html> element.
• From mid-July 2026, from a randomly named attribute on the <html> element.

Request bodies have paramter action=signup and a mode= parameter. The first request is mode=GoToType to retrieve the HTML template for the cloned login page. During Microsoft 365 phishing, after entering an email address, a mode=validem request is sent with the email in the username parameter. After entering a password, a mode=OfficeLogin request is sent with parameters email and epass

Example request format:

POST /m/sc/TLW0GRK4QK9BEUC3SESD5QFVV

action=signup&username=john.doe%40contoso.com&mode=validem

WebSocket C2

Starting in 2026, the Socket.IO library is used to open a WebSocket to a central C2 server (manlivep[.]org). Events emitted by the browser include session:start, session:start:advance, page:authMethodId, and page:authMethod:entercode.