X-SniPer phishing kit even tries to steal the victim’s mobile phone carrier PIN to perform a SIM swap attack to “bypass” 2FA.