An urgent alert has been issued to Gmail and Outlook users due to a new login attack method that steals passwords and compromises accounts. This attack bypasses two-factor authentication (2FA) through session hijacking and real-time credential interception.

SlashNet, the security group that uncovered the scam, reports that the fake login page and phishing campaign can even bypass 2FA. The malicious link is sent to users via email, aiming to infect their devices when clicked.

The new phishing campaign, known as Astaroth, "distinguishes itself by not only intercepting login credentials but also by rapidly capturing 2FA authentication tokens and session cookies as they are generated".

If you're uncertain about the source of an email or something feels off, we strongly recommend thinking twice before clicking any links or providing your information.

If you have concerns, don't hesitate to reach out!