# Can Rockstar 2FA bypass Microsoft 365 MFA?

> Rockstar 2FA is a phishing-as-a-service kit that steals M365 session cookies to bypass MFA. How the AiTM attack works and what actually stops it.

Yes: Rockstar 2FA can get past Microsoft 365 MFA, but not by cracking your second factor. It's a phishing-as-a-service kit that uses an adversary-in-the-middle (AiTM) proxy to steal the live session cookie *after* the user completes MFA. Trustwave SpiderLabs researchers Diana Solomon and John Kevin Adriano documented the toolkit in late November 2024. Here's how it works and what actually stops it.

## Quick Takeaways

- Rockstar 2FA doesn't break MFA, it **steals the session cookie** issued after a legitimate MFA sign-in, then replays it. Per Trustwave, that means "even users with multifactor authentication (MFA) enabled can still be vulnerable."
- It's a **subscription PhaaS kit**, sold from around **$200 for a two-week subscription** (other outlets report ~$350/month) via ICQ, Telegram, and Mail.ru. Trustwave counted more than 1,500 subscribers on its Telegram channel in August 2024.
- Landing pages are built to **mimic Microsoft 365 login pages**; the kit also ships themes for Google, Hotmail, GoDaddy, and generic SSO.
- OTP, SMS codes, and push approvals **do not stop it** once the victim authenticates through the proxy. Only **phishing-resistant MFA (FIDO2/WebAuthn security keys and passkeys)** resists the attack, CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication.
- **DMARC, SPF, and DKIM reduce lure delivery** but don't stop cookie theft after a click, and many Rockstar lures arrive from already-compromised legitimate accounts.

## What is Rockstar 2FA?

Rockstar 2FA is a phishing-as-a-service (PhaaS) toolkit, attackers rent the infrastructure instead of building it. Trustwave traces its lineage to the **DadSec** phishing kit (also called Phoenix), which originated around May 2023, with the Rockstar variant emerging in late 2023. Microsoft tracks the actor cluster behind DadSec/Rockstar as **Storm-1575**.

Worth being precise here: Storm-1575 is Microsoft's temporary tracking label for the DadSec/Phoenix cluster, not a confirmed single group. Because Rockstar 2FA is sold as a service to many unrelated buyers, campaigns using it aren't one coordinated actor, they're whoever paid the subscription that month.

The marketed feature list reads like a SaaS product: 2FA bypass, harvesting of 2FA cookies, antibot protection, multiple login-page themes, randomized source code and attachments, "fully undetectable" (FUD) links, Telegram bot integration, and a user-friendly admin panel for tracking campaigns. That packaging is the point. It lets low-skill buyers run account-takeover campaigns that used to require real technical chops.

## How does the AiTM technique defeat MFA?

This is the mechanic MSPs need to understand, because it changes what "having MFA" actually protects against.

The AiTM proxy sits between your user and the real Microsoft sign-in service as a reverse proxy:

1. The victim clicks a lure and lands on a fake login page that looks like Microsoft 365.
2. They type their username and password. The proxy **relays those to the real Microsoft service** in real time.
3. Microsoft prompts for the second factor. The victim approves the push or enters the OTP, and the proxy passes that through too, completing genuine MFA.
4. Microsoft returns a **valid session cookie** to the browser. The attacker's proxy captures it.

That stolen cookie represents an already-authenticated session. The attacker replays it to access the mailbox **without the password and without triggering MFA again**: the second factor was already satisfied, in real time, through the proxy. This is why one-time passcodes, SMS codes, and push-notification approvals don't help here: they all get completed live and the resulting token is what gets stolen. MFA that relies on a phishable code or tap is defeated not by breaking the factor but by hijacking what the factor produces.

## What lures and evasion tricks does it use?

Rockstar 2FA campaigns are built to reach inboxes and dodge scanners. Reporting from Trustwave, The Hacker News, and BleepingComputer describes a consistent playbook:

- **Delivery from compromised accounts** and abused legitimate services, which passes basic sender checks because the mail genuinely comes from a real, authenticated account.
- **Familiar lure themes**: file-sharing and document notifications, e-signature requests, IT notices, password resets, and payroll alerts.
- **Multiple delivery formats**: direct URLs, QR codes, and HTML and PDF attachments, QR codes and attachments move the malicious link off the message body where filters look.
- **Trusted-platform abuse**: hosting links behind Atlassian Confluence, Google Docs Viewer, Microsoft OneDrive/OneNote, and Dynamics 365 Customer Voice, plus URL shorteners, open redirects, and link-protection rewriters.
- **Antibot filtering**: Cloudflare Turnstile challenges and redirects to decoy pages to screen out automated scanners and researchers before the phishing page ever renders. Trustwave reported more than 3,700 urlscan.io hits matching the campaign's URL pattern since May 2024, and over 5,000 hits on car-themed decoy domains linked to the operation over the same window. (Those are Trustwave's telemetry proxies for a specific window, not total victim counts.)

The kit also promotes "fully undetectable" (FUD) links and obfuscated HTML to slip past URL-based detection and antispam.

## What actually stops Rockstar 2FA?

The uncomfortable answer: most of the MFA you've already rolled out won't. The controls that do work come from CISA and Microsoft, not the Trustwave writeup itself.

**Phishing-resistant MFA is the real fix.** FIDO2/WebAuthn security keys and passkeys are cryptographically bound to the legitimate site's origin, so the credential simply won't authenticate against the attacker's proxy domain, there's nothing for the AiTM relay to forward. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication and describes FIDO2 as the gold standard of MFA. Frame this correctly with clients: passkeys are the mitigation here, not a victim.

**Layer Microsoft's token controls.** Microsoft recommends Conditional Access policies that require a compliant or Microsoft Entra hybrid-joined device, which blocks token issuance to untrusted endpoints like an AiTM proxy, plus **Token Protection (token binding)** in Conditional Access to cut the risk of a stolen token being replayed from another device.

**Reduce lure delivery upstream.** This is where email authentication earns its place. Enforcing DMARC, SPF, and DKIM blocks spoofed and unauthenticated messages that carry these lures. Be honest about the limit, though: authentication doesn't stop credential or session theft once a user reaches the AiTM page, and many Rockstar lures come from genuinely compromised accounts that pass authentication. Treat DMARC as thinning the volume that reaches inboxes, not as an AiTM cure. If you run Managed DMARC across a client portfolio, moving every domain to enforcement is one fewer channel attackers can spoof. Check any domain's posture with the free [DMARC checker](/tools/dmarc) or a full [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### Does MFA still matter if Rockstar 2FA can bypass it?

Yes: just not all MFA equally. Phishable factors (OTP, SMS, push) still block password-only attacks and credential stuffing, so keep them. But against AiTM specifically, only phishing-resistant MFA (FIDO2/WebAuthn keys and passkeys) holds up, because the credential is tied to the real site's origin and can't be relayed through a proxy.

### Will better email filtering stop it?

Filtering reduces how many lures reach users, which matters, but it won't stop well-built AiTM campaigns delivered from compromised senders, hidden behind trusted platforms, or wrapped in QR codes and PDF attachments. Pair filtering with phishing-resistant MFA and Conditional Access.

### Do DMARC, SPF, and DKIM protect against Rockstar 2FA?

They help on the front end by cutting spoofed and unauthenticated mail, but they don't stop session-cookie theft once someone clicks through to the proxy. And lures sent from already-compromised legitimate accounts can pass authentication. Useful layer, not a standalone defense.

### How much does Rockstar 2FA cost attackers?

Trustwave lists roughly $200 for a two-week subscription; some outlets report around $350 for a month. It's marketed and sold via ICQ, Telegram, and Mail.ru, and Trustwave found more than 1,500 subscribers on its Telegram channel in August 2024.

### Who is most at risk?

Any organization that relies on Microsoft 365 with phishable MFA. The kit is built to mimic M365 login pages, and its subscription model puts credible AiTM phishing in reach of low-skill buyers, which is exactly why the defensive bar has moved to phishing-resistant MFA.

Want to see which of your client domains still let spoofed lures through? Run the free [Email Security Score](/tools/email-security-score): it checks DMARC, SPF, and DKIM in seconds.

## Related reading

- [DMARC checker](/tools/dmarc)
- [Microsoft compliance checker](/tools/microsoft-compliance-checker)
- [DMARC automation for MSPs](/for-managed-service-providers)