Tycoon Phishing Kit Uses Multiple Attack Vectors
The cybersecurity community has expressed significant concerns over a recently discovered phishing toolkit called Tycoon 2FA. Uncovered by the Sekoia Threat Detection & Research (TDR) team in October 2023, and discussed in an advisory released today, this kit employs the Adversary-in-The-Middle (AiTM) technique and is purportedly used by multiple threat actors to conduct widespread and effective attacks.
According to Sekoia's findings, the Tycoon 2FA platform has been active since at least August 2023, and the company has been diligently monitoring its associated infrastructure since its discovery. Their analysis indicates that Tycoon 2FA is one of the most prevalent AiTM phishing kits, with over 1,100 domain names detected between October 2023 and February 2024.
The Tycoon 2FA phishing kit operates through several stages to carry out its malicious activities efficiently. Initially, victims are directed via email attachments or QR codes to a page featuring a Cloudflare Turnstile challenge aimed at deterring unwanted traffic. After completing this challenge, users encounter a counterfeit Microsoft authentication page, where their credentials are harvested. The kit then relays this information to the legitimate Microsoft authentication API, intercepting session cookies to bypass Multi-Factor Authentication (MFA).
New Tycoon Version Comes with Significant Changes
In their latest advisory, Sekoia notes the identification of a new version of Tycoon 2FA in February 2024, featuring significant changes to its JavaScript and HTML codes, thereby enhancing its phishing capabilities. Notable alterations include the exclusion of the Cloudflare Turnstile challenge from the initial HTML page and the consolidation of former separate JavaScript downloads into stages handling 2FA implementation and data transmission. Moreover, the kit employs refined stealth tactics, delaying malicious resource provision until after the Cloudflare challenge resolution and using randomly named URLs to evade detection.
Sekoia also alerts about potential connections between Tycoon 2FA and other known phishing platforms, suggesting shared infrastructure and possibly shared code bases, urging heightened vigilance against such threats.
