Loading threat actor…
Tycoon 2FA is a phishing-as-a-service platform that emerged in August 2023 and is designed to bypass multi-factor authentication, particularly against Microsoft 365 and Gmail accounts. It operates as an adversary-in-the-middle reverse-proxy phishing kit that captures credentials, session cookies, and MFA inputs in real time while presenting victims with convincing counterfeit authentication pages. The service has been used in broad credential-phishing campaigns and has been associated with large-scale activity in 2024. Tycoon 2FA is notable for layered anti-analysis and anti-detection tradecraft. Reported features include CAPTCHA gating, domain validation, bot and scanner filtering, debugger checks, staged payload delivery, obfuscated JavaScript, DOM self-removal to hinder inspection, and encrypted retrieval of later-stage content. The platform dynamically adapts phishing flows based on responses from legitimate authentication services, including prompting for MFA codes and tailoring pages according to organizational login behavior and policy cues. It also collects victim telemetry such as browser and geolocation data to support campaign operations. The platform has been distributed through phishing lures delivered by email and document-based or link-based workflows, including QR-code-driven campaigns and attachments themed around payroll, bonuses, and holidays. Fake login pages have been hosted on cloud infrastructure, and the service has been used by affiliates to harvest credentials and authenticated sessions from enterprise users. Stolen access obtained through Tycoon 2FA can enable follow-on activity including unauthorized access to cloud email and storage, post-compromise account abuse, lateral movement, and data theft. Tycoon is part of the broader criminal phishing-service ecosystem and has been discussed alongside related MFA-phishing platforms such as DadSec, Rockstar2FA, and FlowerStorm. Similarities with other Telegram-enabled phishing services have been noted, but high-confidence attribution to a specific state sponsor or national operator is not available. Tycoon 2FA is best characterized as a financially motivated cybercriminal service offering focused on scalable credential theft and session hijacking.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a prior phishing-as-a-service operation whose affiliates used calendar invites linking to credential-harvesting pages; mentioned only as background comparison.
A Telegram bot-powered phishing-as-a-service platform referenced as sharing features with FlowerStorm and Rockstar2FA.
Operates a phishing-as-a-service adversary-in-the-middle campaign that targets Microsoft 365 and Gmail accounts, steals credentials, session cookies, and MFA codes in real time, and uses anti-analysis checks such as CAPTCHA, bot detection, debugger detection, and dynamic phishing page generation.
Providing Phishing-as-a-Service (PhaaS) platforms to enable other threat actors to conduct phishing campaigns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.