A new phishing kit called Tycoon 2FA has caught the attention of cybersecurity experts, raising concerns in the online security community. Discovered by the Sekoia Threat Detection & Research (TDR) team in October 2023, this kit is linked to the Adversary-in-The-Middle (AiTM) technique and has been reportedly used by multiple threat actors to carry out widespread attacks.
Since its discovery, Sekoia has been closely monitoring the activities of the Tycoon 2FA platform, which has been active since at least August 2023. The analysis conducted by the firm revealed that this phishing kit has become one of the most prevalent AiTM phishing kits, with over 1,100 domain names detected between October 2023 and February 2024.
The Tycoon 2FA phishing kit operates through various stages to carry out its malicious activities effectively. Victims are initially directed to a page featuring a Cloudflare Turnstile challenge before encountering a fake Microsoft authentication page where their credentials are harvested. The kit then relays this information to the legitimate Microsoft authentication API, bypassing Multi-Factor Authentication (MFA).
In a recent advisory, Sekoia highlighted a new version of Tycoon 2FA discovered in February 2024, which includes significant changes to its JavaScript and HTML codes to enhance its phishing capabilities. The updated version features improvements in resource retrieval, traffic filtering, and evasion tactics to thwart analysis attempts.
Sekoia also warned about potential connections between Tycoon 2FA and other known phishing platforms, suggesting shared infrastructure and code bases. Analysts believe that the operations associated with the Tycoon Group are highly profitable, making the Tycoon 2FA PhaaS a significant threat in the AiTM phishing market for 2024.