Loading threat actor…
Storm-1747 is a financially motivated cybercrime threat actor tracked as the developer and operator of the Tycoon2FA phishing-as-a-service platform, one of the most prolific adversary-in-the-middle phishing ecosystems observed since its emergence in August 2023. The group built, maintained, advertised, and leased Tycoon2FA to downstream criminals, enabling large-scale credential theft and session hijacking against cloud identity and productivity services, especially Microsoft 365 and Google Workspace. Known activity shows the actor selling access to a web-based administration panel and phishing kit infrastructure through criminal messaging channels, while customers conducted their own campaigns using the service. Storm-1747 specializes in AiTM phishing that proxies legitimate authentication flows in real time, captures credentials and post-authentication session tokens, and bypasses common MFA methods such as SMS codes, authenticator codes, and push approvals. Tycoon2FA phishing pages impersonate enterprise sign-in portals including Microsoft 365, Outlook, SharePoint, OneDrive, Gmail, Okta, and DocuSign. Campaign delivery has included links and attachments themed as business documents, HR notices, payroll messages, shared files, voicemails, and QR-code lures. The actor’s tooling has supported victim tracking, redirect logic, lure generation, and near-real-time forwarding of stolen data to operators. The group demonstrates strong defense-evasion tradecraft. Reported techniques include anti-bot screening, browser fingerprinting, self-hosted CAPTCHA challenges, dynamic decoy pages, heavy JavaScript obfuscation, multi-hop redirect chains, disposable short-lived domains, and rapid infrastructure rotation. Tycoon2FA infrastructure has also been associated with filtering of cloud and hosting-provider traffic, blocking of developer tools and automation frameworks, and per-session payload customization. Post-compromise activity enabled by the platform has included account takeover, business email compromise, data theft, and lateral movement in cloud environments. Microsoft-focused variants have additionally been reported to establish persistence by registering rogue devices in Entra ID to obtain refresh-token-based access that can survive ordinary session revocation. Storm-1747 has been linked to very high-volume phishing operations affecting more than 500,000 organizations per month at peak and accounting for a majority share of AiTM phishing attempts blocked by Microsoft during parts of 2025. Victim organizations have spanned multiple sectors, with healthcare and education repeatedly identified among the hardest hit, alongside finance, government, and non-profit entities. The actor has also been observed leveraging RedVDS infrastructure, a cybercrime-enabling virtual server service used by multiple financially motivated groups. A multinational disruption in March 2026 targeted Tycoon2FA infrastructure and significantly impaired operations, but reporting indicates the ecosystem adapted and resumed activity shortly afterward, including overlap with OAuth device-code phishing and possible operational connections with other phishing-kit frameworks. Storm-1747 is best understood as a cybercrime service operator whose core role is enabling scalable MFA-bypass phishing and downstream account-compromise fraud rather than conducting a single narrowly scoped intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operator of the Tycoon2FA phishing-as-a-service platform, renting an adversary-in-the-middle phishing kit to customers to steal credentials and session tokens and bypass traditional MFA.
Operates or is attributed with the Tycoon 2FA phishing-as-a-service campaign, conducting adversary-in-the-middle phishing to steal authenticated session tokens from Microsoft 365 and Google Workspace accounts and bypass MFA.
Highly prolific AiTM phishing platform responsible for a large share of Microsoft-blocked AiTM phishing attempts before rapidly recovering after disruption.
Highly prolific adversary-in-the-middle phishing platform operating at large scale before and after law-enforcement disruption.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.