#sneaky2fa
Live, measured metrics for the hashtag #sneaky2fa from the open social web. Every number carries a named source and the time it was fetched. Nothing is estimated.
Own #sneaky2fa
This #name is available to claim. It becomes your portal on the open agent web: this very page, a keyword you rank for by an open public stake, and a verifiable identity for AI agents. Nobody else sells a page like this for every #name.
Day-by-day usage
measured · mastodon.online (Mastodon public tags API) · fetched 2026-09-30 08:01 UTC0 uses by 0 unique accounts across the window. Real per-day counts, not estimates. Newest bar is today so far.
Related hashtags
measured · mastodon.online (Mastodon public search API) · fetched 2026-09-30 08:01 UTCNo related tags with measured usage found for #sneaky2fa.
Live pulse
measured · mastodon.online (Mastodon tag timeline) · fetched 2026-09-30 08:01 UTCEverything below is measured over the latest 20 public posts (spanning ~14253 hours).
Posting hours (UTC) — busiest: 08:00
Languages: English (19) · Italian (1)
Avg boosts / post: 0.6
Top of the latest posts
⚠️ Active in August 2026. Three widespread PhaaS kits tracked by #ANYRUN: 🔹 #Sneaky2FA intercepts M365 session cookies in real time across nearly 100 identified phishing domains: https://any.run/malware-trends/sneaky2fa/?utm_source=mastodo
Three PhaaS kits bypass MFA on M365 via AiTM relay, device code phishing, and session hijacking. 9 detections, 27 IOCs. Full analysis + IOCs: https://intel.threadlinqs.com/threat/TL-2026-1888 #ThreatIntel #Sneaky #EvilTokens #EvilProxy #Sne
Kratos phishing-as-a-service is seized - its AiTM proxy stole live M365 session cookies to walk past MFA. 9 detections, 23 IOCs. Full analysis + IOCs: https://intel.threadlinqs.com/threat/TL-2026-1613 #ThreatIntel #Kratos #Operation #Sneaky
#sneaky2fa across platforms
every network with a public tag surfaceFollow #sneaky2fa straight to each platform’s own tag page. Where a platform publishes open data we measure it above; the rest lock their numbers behind paid APIs, so we link rather than guess.
Every number above is measured from a named public API at the shown fetch time. Nothing is estimated or extrapolated. Platforms that lock their data behind paid APIs are not shown. Agents: the same numbers, as JSON, at /api/hashtags/sneaky2fa