Phishing attacks are everywhere, and most of us can spot the obvious ones. Even if someone falls for one and hands over their password, two-factor authentication (2FA) usually adds a crucial layer of protection. But a new phishing kit making the rounds can bypass 2FA entirely by using session hijacking and real-time credential interception.
Known as Astaroth, this tool intercepts and manipulates traffic between your device and legitimate authentication services like Gmail, Yahoo and Microsoft. Since it grabs everything in real time, it completely bypasses 2FA and gives attackers full access to your account.
Stay protected & informed! Get security alerts & expert tech tips – sign up for Kurt’s The CyberGuy Report now.
Illustration of a hacker at work (Kurt “CyberGuy” Knutsson)
How Astaroth works
Astaroth is a next-level phishing kit that takes scamming to a whole new level. Instead of using basic fake login pages like traditional phishing kits, it works as a middleman between your device and the real authentication service while silently grabbing everything needed to break in.
The attack begins when you click on a phishing link and land on a malicious site that looks identical to the real one. Since the site has valid SSL certificates, there are no red flags, no security warnings and no sketchy pop-ups. When you enter your login details, including username, password, device info and IP address, Astaroth snatches them up before passing the request to the actual website.
Two-factor authentication is not a problem for Astaroth. It intercepts one-time passwords the second they are entered, whether they come from an authenticator app, SMS or a push notification. The stolen codes are instantly sent to the attacker through a web panel or Telegram alert, so they can use them before they expire.
The real kicker is that Astaroth also grabs session cookies, which are the small bits of data that keep users logged in after authentication. Attackers can inject these cookies into their own browsers, skipping the need for passwords or two-factor authentication altogether. Once they have the session, they are in with no extra steps required.
An example of what the victim and attacker would see (SlashNext) (Kurt “CyberGuy” Knutsson)
BEST ANTIVIRUS FOR MAC, PC, IPHONES AND ANDROIDS – CYBERGUY PICKS
Astaroth is shockingly advanced
As reported by cybersecurity company SlashNext, Astaroth stands out from other phishing kits because of its ability to intercept credentials in real time, automate attacks and resist takedown efforts. Traditional phishing depends on tricking victims into entering their credentials on fake login pages, but Astaroth removes that step entirely.
Beyond its advanced capabilities, Astaroth comes with features that make it appealing to cybercriminals. It uses bulletproof hosting to stay online despite law enforcement efforts, receives frequent updates to bypass security patches and follows a structured payment model. For $2,000, buyers get six months of continuous upgrades. To build trust, the creators even let hackers test the phishing kit before purchasing.
Astaroth is widely available through Telegram and underground cybercrime forums. The anonymity of these platforms makes it difficult for authorities to track distribution.
The seller sharing information on testing the phishing kit out (SlashNext) (Kurt “CyberGuy” Knutsson)
HOW TO PROTECT YOUR DATA FROM IRS SCAMMERS THIS TAX SEASON
Signs you may be infected with Astaroth
1) Unexpected account logins or security alerts
- You receive alerts from Gmail, Microsoft or other services about a login from an unknown device or location
- You get a 2FA request when you weren’t trying to log in
2) You’re mysteriously logged out of accounts
- If your session cookies were stolen, an attacker might log in as you and force a log-out elsewhere
3) Password changes or settings updates you didn’t make
- If an attacker has control, they may change recovery emails, phone numbers or passwords
4) Slow system performance or odd behavior
- Astaroth uses legitimate Windows processes (like WMIC, BITSAdmin or Regsvr32) to hide itself
- If your system is sluggish or the Task Manager shows strange processes using high CPU/network with no explanation, that could be a clue
5) Browser acting strangely
- Login fields autopopulate incorrectly or redirect loops occur
- Pages that used to work suddenly trigger warnings or errors
6) Unfamiliar programs or scripts running in the background
- Check for odd Scheduled Tasks, Registry changes or background network connections (especially if they’re outbound to suspicious domains or IPs).
What to do if you suspect infection
- Disconnect from the internet immediately
- Run a full malware scan using trusted antivirus software
- Check for unauthorized logins on your major accounts and change all passwords on another trusted device
- Enable passkeys or hardware security keys where possible
- Reset your device if malware persists; a full factory reset may be required
- Monitor bank accounts and email inboxes for suspicious activity
4 ways to stay safe from Astaroth phishing attacks
1) Avoid unknown links and use strong antivirus software: Remember that no matter how advanced the malware is, it still needs input from you. In most cases, an attacker will require you to click a link before they can steal your data. For example, for Astaroth to work, you have to click a link, visit a malicious website and enter your credentials. If you don’t click the link, you stay clear of the malware.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS device.
2) Double-check sites: Always verify website addresses and use bookmarks for trusted sites. Instead of clicking on links in emails or messages, manually type the URL or use a trusted bookmark. This minimizes the risk of landing on a fraudulent page designed to mimic a legitimate website.
3) Update your devices: You might wonder how keeping your devices updated helps against malware like Astaroth. While it doesn’t directly prevent an attack, it ensures the situation doesn’t get worse. Keeping your operating system and applications up to date with the latest security patches closes vulnerabilities that malware might exploit, making it harder for attackers to gain a foothold on your device.
4) Avoid typing passwords: Avoid entering passwords whenever possible to reduce the risk of credential theft. Instead, use authentication methods like passkeys, Google Sign-In or Apple Sign-In.
A passkey is a feature that uses cryptographic key pairs to verify your identity, eliminating the need for traditional passwords. It allows you to sign in to apps and websites using the same process you use to unlock your device, such as biometrics, PIN or pattern.
Google Sign-In is a feature that allows you to log in to third-party apps or websites using their Google Account credentials. It simplifies the sign-in process by eliminating the need to create and remember separate usernames and passwords for each service. You can sign in via a “Sign in with Google” button, a Google sign-in prompt or automatic sign-in if previously authorized.
Apple Sign-In is a feature that enables you to privately sign in to participating third-party apps and websites using your Apple ID. It offers a fast, easy and more private way to authenticate without the need to create new accounts or remember additional passwords. To set up an account to “Sign in with Apple,” when a participating website or app asks you to set up or upgrade an account, do the following: Tap Sign in with Apple. Follow the onscreen instructions. Some apps (and websites) don’t request your name and email address. In this case, you simply authenticate with Face ID or Touch ID (depending on your model), then start using the app. Others may ask for your name and email address to set up a personalized account. When an app asks for this information, Sign in with Apple displays your name and the personal email address from your Apple Account for you to review.
These methods rely on cryptographic keys or secure tokens, making it much harder for attackers to intercept your login information, even if they manage to trick you into visiting a malicious site.
FBI WARNS OF DANGEROUS NEW ‘SMISHING’ SCAM TARGETING YOUR PHONE
Kurt’s key takeaway
Astaroth shows just how far phishing kits have come, taking things beyond the usual tricks and bypassing 2FA with ease. It’s a reminder that no matter how secure we think our systems are, there’s always a smarter attack waiting to exploit the gaps. Cybercriminals are adapting fast, and while traditional defenses may not cut it anymore, there are still steps you can take to fight back: use passwordless logins, stay updated and keep learning about these evolving threats.
What do you think governments and companies should be doing to protect you from sophisticated cyber threats like the Astaroth phishing kit, which can bypass traditional security measures? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
