New Phishing As A Service kit out there, bypasses 2fa from Microsoft, Google, possibly others

Cybercriminals have been increasingly using a new phishing-as-a-service (PhaaS) platform named ‘Tycoon 2FA’ to target Microsoft 365 and Gmail accounts and bypass two-factor authentication (2FA) protection.

Tycoon 2FA was discovered by Sekoia analysts in October 2023 during routine threat hunting, but it has been active since at least August 2023, when the Saad Tycoon group offered it through private Telegram channels.

The article continues:

In 2024, Tycoon 2FA released a new version that is stealthier, indicating a continuous effort to improve the kit. Currently, the service leverages 1,100 domains and has been observed in thousands of phishing attacks.

There are 7 stages that this attack uses. They’re numbered 0-6 below.

• Stage 0 – Attackers distribute malicious links via emails with embedded URLs or QR codes, tricking victims into accessing phishing pages.
• Stage 1 – A security challenge (Cloudflare Turnstile) filters out bots, allowing only human interactions to proceed to the deceptive phishing site.
• Stage 2 – Background scripts extract the victim’s email from the URL to customize the phishing attack.
• Stage 3 – Users are quietly redirected to another part of the phishing site, moving them closer to the fake login page.
• Stage 4 – This stage presents a fake Microsoft login page to steal credentials, using WebSockets for data exfiltration.

Stage 5 – The kit mimics a 2FA challenge, intercepting the 2FA token or response to bypass security measures.

• Stage 6 – Finally, victims are directed to a legitimate-looking page, obscuring the phishing attack’s success.

This kit has recently been updated to become more stealthy.

For example, the kit now delays loading malicious resources until after the Cloudflare Turnstile challenge is resolved, using pseudorandom names for URLs to obscure its activities.

The article also talks about the use of the bitcoin wallet receiving quite a bit of money. And as for the domains, there are at least 1100 different domains observed in the research.

Have fun with this one. New MFA-bypassing phishing kit targets Microsoft 365, Gmail accounts is the article.

Hunches are, we may want to talk about this, but I’ll let listener and co-hosts decide.