Loading threat actor…
Mamba 2FA is a phishing-as-a-service (PhaaS) platform identified as a major competitor to Tycoon 2FA. Reporting cited in the provided content states that Mamba 2FA was already operating at nearly 8 million attacks per month before disruption of Tycoon 2FA and then increased to more than 15 million attacks per month afterward, making it one of the primary beneficiaries of the resulting market shift. Barracuda observed increased phishing campaign activity involving Mamba 2FA after the Tycoon 2FA takedown and assessed that Tycoon 2FA tools, code, and techniques are now in the hands of competitors such as Mamba 2FA. The content further states that competing phishing kits, including Mamba 2FA, have improved their features and infrastructure maturity, often using tools formerly associated with Tycoon 2FA. No additional aliases or subgroup information for Mamba 2FA are provided in the content.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An established phishing platform that increased campaign activity following the Tycoon 2FA takedown.
A competing phishing-as-a-service group that significantly expanded after Tycoon 2FA's takedown and absorbed techniques and operators from the disrupted ecosystem.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.