#tycoon2fa

Cybercriminals are now chaining up to six layers of URL rewrites from vendors including Cisco, Sophos, and Barracuda to make phishing links appear to originate from trusted security platforms — and it's working well enough to steal credentials and session tokens at scale.

Source: LevelBlue

Large scale disruptions are rather few and far between. In the six months I’ve been writing these reports, only one or two come to mind compared to near constant campaigns and incursions. Part of this is because disruptions at scale take time and effort to coordinate on a ‘battlefield’ that’s always changing. But today I get to add another to their number. Europol, in conjunction with Microsoft, TrendAI™, CloudFlare, Coinbase, Crowell, eSentire, Health-ISAC, Intel471, Proofpoint, Resecurity, The Shadowserver Foundation, SpyCloud, and other law enforcement agencies have successfully seized over 300 domains associated with the phishing-as-a-service known as Tycoon2FA.

Threat actors such as Tycoon2FA are not attackers in their own right. Instead they provide man-in-the-middle type services, linking lesser skilled operators with effective toolkits that they don’t necessarily need to understand, since the service does all the work. In this case, that service is as a proxy in between attackers, their victims, and legitimate login pages. Once infiltration is successful, they harvest credentials, MFA codes, and session cookies in real time. That data is then sent back to the ‘client’ to replay when MFA is enabled to take over accounts. This can create a cascading effect beyond the original point of compromise, as stolen sessions and accounts can be reused, resold, and repurposed across multiple operations.

Trend Micro states that, at the time of yesterday’s report, Tycoon2FA had some two thousand users, with over 24,000 domains since its arrival on the scene in 2023. The platform operates at a large scale, providing a ready to use toolkit that requires little setup by those using it. Some versions include evasion features to make detection more difficult, like anti-bot screening, browser fingerprinting, heavy code obfuscation, self-hosted CAPTCHAs, custom JavaScript, and dynamic decoy pages.

In terms of financial damage, phishing does not compare to something like ransomware, but Trend Micro warns that it shouldn’t underestimated, since the tactic is widespread and often easily missed, since it requires the victim to take the bait to be initialized. They go on to say that operations like these are hard to track due to the very nature of phishing. The infrastructure, hosting, and victims involved are spread across many countries and networks, and need the cooperation of many levels of detection, analysis and legal authority to disrupt. Microsoft Threat Intelligence, who also published a report on this disruption, states that campaigns using Tycoon2FA have appeared across nearly all sectors including education, healthcare, finance, non-profit, and government. The platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail. By stealing session cookies and MFA codes, persistence can be enacted even after passwords are reset unless explicitly revoked (when one clears their browser of all history and cookies, which is a good preventative measure to begin with).

While this disruption does not mitigate the damage done to already compromised victims, it does hinder subsequent attack campaigns. A coordinated effort involving tracking, analysis, and disruption efforts makes it harder for operations to rebuild and reuse tools, or move to a new platform without being noticed at least in the short to medium term by someone. Trend Micro, for instance, states that it will continue to monitor any activity that might resemble Tycoon2FA, while MTI offers a variety of tips for users to protect themselves now and in the future. Congrats to all those involved in this disruption, it was a lot of hard work and cooperation. I tip my hat to you all.

Attackers are abusing complex email routing and spoofing gaps to send phishing emails that appear to come from inside the victim’s own organisation.

Source: Microsoft Threat Intelligence

Stolen identities, not software flaws, now drive over half of all cyberattacks. Attackers use subscription phishing kits and infostealer malware to hijack email accounts and bypass defences within hours.

Source: eSentire | eSentire Report PDF

In March, I reported on a major disruption headed by Europol and assisted by numerous security and law enforcement agencies. 300 domains associated with Tycoon2FA were seized, and at the time I stated that disruptions like this make it more difficult for malware platforms to reorganize themselves and start over. Difficult, but not impossible, and becoming less so every day.

On Thursday, Barracuda published an article on how Tycoon2FA has re-emerged – or at least its ecosystem has – under a number of new names. While the disruption did successfully curtail activity from the phishing-as-a-service provider, ultimately the infrastructure of the malware remained in place. In essence, the disruption took down the ‘brand’, not the product. What’s been observed by Barracuda’s researchers is behavior and toolkits known to be used by Tycoon2FA in other variants of adversary-in-the-middle attacks. They use the same keywords in coding commands, as well as the unique anti-analysis, anti-debugging and redirection capabilities. Several of them even keep the ‘2FA’ in their name.

There are reasons why disruptions can be incomplete. Phishing toolkits have evolved to resemble open source development. They use many of the same underlying codes, allowing them to be cloned, modified and/or redistributed into the larger environment of darkweb marketplaces. Threat actors also often maintain backups, meaning that seizure doesn’t capture or dismantle the source code. Or what continues in the interim after a major disruption is so ‘quiet’ and low level that it doesn’t trip any alerts until it’s well established again. Seizure doesn’t automatically revoke the access gained by stolen data like session cookies and authentication tokens either. Domain seizure does not mean the end of compromise when PhaaS threat actors are selling that data to their peers.

This isn’t the first time I’ve reported on a resurgence of a malware family. One of my very first reports was on the return of LummaStealer after disruption. In October, I talked about the sibling variant of Lactrodectus, YiBackdoor. And in January I reported on GoBruteForcer’s return after it integrated AI logic trees to expand its spray and pray tactics against legacy web server software. What’s old always finds a way to be new again.

Just this past Friday, in my report on vibeware, I paraphrased Jason Soroko of Sectigo, who said that defending against malware campaigns should be less about the construction (or in this case, the ‘brand’), and more about the behavior. It doesn’t matter what it’s called, what matters is what it does and how to stop it. And a single variant is just that. A variant. In order to truly eradicate a threat, one must take down every tendril of it, or it will just ‘grow’ back. It’s akin to combating stubborn weeds or, perhaps more aptly, a medication resistant infection. Barracuda’s article points out that security defenses need to look more broadly than individual players, because focusing detection on individual kits isn’t enough. They migrate too quickly, with proven techniques being inherited and refined by the next actor.

The solution to keeping phishing campaigns under control is mostly one of awareness. I don’t expect coordinated defense operations to account for every single copy, as that is a nearly impossible task considering backups are often not accessible remotely. Very rarely are these operations storming a physical location and taking servers apart by hand. But the entire point of threat detection is being vigilant, and keeping in mind that variants will pop up shortly thereafter should be part of the plan of action. The other side of this coin is the victim, whether that is past or future intended. Compromised credentials need to be changed, so that stolen data from successful incursions is rendered moot.

Reports like mine, and all those who publish them like Barracuda, are an important part of awareness too. But they only work if people are reading them, and thereby being proactive in their own security. I’ve said it before, and no doubt I’ll say it again: campaigns don’t end just because a vector has been closed. Threat actors will just find a new one.

The Tycoon2FA phishing-as-a-service platform resumed operations after a Europol disruption, continuing MFA-targeted attacks with adversary-in-the-middle and AI-generated decoy pages.

Source: CrowdStrike

Read the full report on -