For years, the managed services community viewed multifactor authentication (MFA) as the ultimate “get-out-of-jail-free” card. The logic was sound: even if a user fell for a flashy lure, the second factor would serve as an impenetrable barrier.
But the digital underground has undergone an industrial revolution. Phishing-as-a-Service (PhaaS) has evolved from a boutique hobby into a massive, automated business model that treats your clients’ credentials as a high-velocity commodity.
At Barracuda, we’re seeing this evolution firsthand. Recent research into sophisticated platforms, including the Saiga 2FA and Tycoon 2FA phishing kits, shows that attackers aren’t just breaking in; they’re logging in with the very tools meant to keep them out. For MSPs, this isn’t just a new technical hurdle. It’s a signal that they must rearchitect their defense of the identity perimeter.
The commoditization of adversary-in-the-middle attacks
These kits pose a risk by reducing the barrier to entry for minor offenders while offering advanced functionality. In the past, bypassing MFA required significant technical expertise. Today, PhaaS providers offer adversary-in-the-middle (AiTM) capabilities as a subscription service.
Platforms like Tycoon 2FA serve as transparent proxies between the victim and a legitimate login page. When a user enters their credentials and MFA token, the kit captures the session cookie in real time. This allows the attacker to bypass the need for a password or a second code entirely. According to the 2026 Managed XDR Global Threat Report, identity-based attacks are now a primary red flag, with 100% of security incidents involving at least one unprotected or rogue endpoint.
These types of phishing kits are often marketed as boutique services. The Saiga 2FA kit, for instance, focuses on high-quality, localized lures that are nearly indistinguishable to the average user from a legitimate Microsoft 365 or Google Workspace prompt. Because these kits are constantly updated by their developers to evade detection, they compress the attack timeline. We’ve seen the time from initial breach to full ransomware encryption drop to as little as three hours.
Why the PhaaS economy is accelerating risk
The economics of PhaaS are what truly shift the scale. Cybercriminals no longer need to build their own infrastructure; they only need a credit card or cryptocurrency. This creates a force-multiplying effect, enabling a single kit developer to empower thousands of affiliates to launch global campaigns.
This industrialization means MSPs are no longer defending against a single hacker but against an entire supply chain of malicious actors. When phishing kits can bypass traditional defenses in milliseconds, the “clean room” of a standard security setup isn’t enough. We’re seeing a fundamental shift in attacker tradecraft, with the focus moving from compromising systems to compromising identities.
Evolving the security stack for the agentic era
To stay ahead of these industrialized threats, you can’t rely on yesterday’s tools. MFA remains essential, but it’s no longer sufficient on its own. MSPs must transition from facilitators of productivity to strategic architects of resilience.
Here’s how you can evolve your strategy to counter 2FA-aware phishing:
- Implement phishing-resistant MFA: Standard SMS or push notifications are vulnerable to relay attacks. Moving clients toward FIDO2 security keys or biometric authentication (e.g., Windows Hello) provides a much higher level of protection because these methods are tied to the physical device and the specific domain.
- Prioritize behavioral analytics: Because attackers use legitimate session cookies to log in, you need tools that detect anomalous behavior rather than just malicious files. Our SOC Threat Radar has shown that monitoring for “impossible travel” or logins from a restricted country at 3 a.m. is a critical line of defense.
- Adopt managed XDR: The sheer volume of alerts from these high-velocity kits is too much for a human team to manage alone. By combining AI-driven detection with 24/7/365 human expertise, you can bridge the gap between detection and remediation.
- Focus on session management: Because these kits steal session cookies, MSPs should enforce shorter session lifetimes and implement conditional access policies that require re-authentication whenever a user’s risk level changes.
Turning the threat into a differentiator
While the rise of PhaaS is a serious challenge, it also presents a major opportunity for MSPs to break through the labor-to-revenue ceiling. By shifting from “keeping the lights on” to selling measurable risk reduction, you become an indispensable partner to your clients.
The best partners today are customer-obsessed and lead with a security-first mindset. They don’t just use a tool; they integrate into a partner-focused ecosystem to create joint value. When you can show a client exactly how many threats were neutralized at the gateway – and how your stack prevented a credential harvest that could have cost them millions – you’re not just a vendor. You’re a strategic growth engine.
The goal isn’t to halt the evolution of AI and automation in the hands of attackers, but to ensure that humans remain the ultimate authority in the network. By hardening the identity perimeter and adopting a managed XDR model, you can transform AI compliance and security pressures into a growth lever for 2026 and beyond.
