Loading story…
Threat researchers reported an ongoing credential-harvesting operation attributed to the Tycoon 2FA phishing kit, repeatedly leveraging newly registered *.contractors domains to host convincing Gmail and Microsoft 365/Outlook login lures. Observed pretexts include ICANN-related “email verification,” document-sharing prompts, and account-security warnings, with consistent infrastructure and execution flow across waves of activity.
Technical analysis of the phishing HTML/JavaScript and runtime behavior indicates MFA-aware logic and extensive anti-analysis tradecraft typical of Tycoon 2FA, including developer-tools and sandbox/analysis-environment detection, debugger timing checks, and forced redirects/termination when inspection is detected. The campaign’s use of obfuscation and encrypted runtime loaders is intended to hinder static and dynamic analysis while enabling real-time credential capture against enterprise email identities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A Reddit post on r/netsec highlighted the Tycoon 2FA phishing campaign and pointed readers to the external technical analysis. The post amplified awareness of the campaign's abuse of *.contractors domains for Gmail and Microsoft 365 credential harvesting.
A malware-analysis blog published technical findings with high-confidence attribution of the campaign to the Tycoon 2FA phishing kit. The write-up documented observed URLs, lures, execution flow, anti-analysis behavior, and noted the listed infrastructure represented only a subset of the broader campaign.
An ongoing phishing campaign used newly registered *.contractors domains, along with related infrastructure, to deliver Gmail and Microsoft 365 credential-harvesting pages. The operation employed Tycoon 2FA-style MFA-aware phishing flows, fake CAPTCHA gates, obfuscated client-side code, and benign decoy redirects to evade analysis and prolong domain use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcemalwr-analysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Tycoon2FA** phishing-as-a-service platform has resurfaced after a law enforcement disruption and is now using **OAuth 2.0 device authorization grant** abuse to compromise **Microsoft 365** accounts protected by multifactor authentication. According to eSentire, the campaign begins with lure emails carrying **Trustifi** click-tracking URLs and guides victims through a multi-stage redirection chain, including a fake Microsoft CAPTCHA page, before directing them to Microsoft’s legitimate device login portal at `microsoft.com/devicelogin`. Rather than exploiting a software flaw or directly bypassing MFA, the operation relies on social engineering to convince users to enter a device code and approve token issuance for an attacker-controlled device, giving the threat actor OAuth tokens for account access. Researchers said the kit retains much of the four-layer in-browser delivery chain seen in earlier Tycoon2FA variants while adding anti-analysis measures to hinder researchers and scanners; recommended defenses include disabling device-code flow where it is not needed, tightening OAuth consent controls, and increasing monitoring of Microsoft Entra logs.
Jun 29, 2026
Microsoft’s Digital Crimes Unit (DCU), **Europol**, and multiple private-sector partners disrupted the **Tycoon 2FA** phishing-as-a-service (PhaaS) operation, an **adversary-in-the-middle (AiTM)** kit used to bypass **multifactor authentication (MFA)** at scale. The action included infrastructure seizures (reported as **hundreds of domains**, including **330** in one account) and takedown of panels and phishing pages under legal process, targeting a service active since 2023 and associated by Microsoft with the threat actor **Storm-1747**. Tycoon 2FA was used to impersonate common enterprise identity targets (notably *Microsoft 365* and *Gmail*) and to capture **credentials plus session cookies/tokens**, enabling account takeover even after password resets unless sessions/tokens are revoked. Reporting and partner telemetry described Tycoon 2FA as a high-volume AiTM threat responsible for **tens of millions of phishing messages** and broad cross-sector targeting (including **education** and **healthcare**). Microsoft stated Tycoon 2FA represented a large share of the phishing it blocked and tied activity to a substantial victim set, while Proofpoint characterized it as the highest-volume AiTM phishing threat in its data and said the disruption—supported by organizations including **Cloudflare**, **Coinbase**, **Health-ISAC**, and others—would materially impact Tycoon 2FA-related infrastructure and actor activity. Separately, LastPass warned of a distinct phishing campaign using spoofed security alerts and a lookalike domain (`verify-lastpass[.]com`) to steal master passwords; this is unrelated to the Tycoon 2FA disruption.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026