Ankura CTIX FLASH Update - March 29, 2024

Ransomware/Malware Activity

Tycoon 2FA Phishing Kit Bypasses MFA for M365 and Gmail

Tycoon 2FA is a phishing-as-a-service (PHaaS) platform which has been on the dark market since at least August 2023. A new version of the Tycoon 2FA was released in 2024, introducing a stealthier phishing kit with updates to its JavaScript and HTML code. Tycoon 2FA has been observed in thousands of phishing attacks targeting login credentials for M365 and Gmail. The attack leverages a reverse proxy server which hosts a phishing webpage designed to mimic a legitimate service to steal credentials provided by the victim. In the first step of the attack chain, victims are sent a phishing email containing a malicious link or QR code crafted to lure them into visiting the phishing webpage. The phishing webpage presented is determined by extracting the victim's email address from the original malicious URL which directs them to the spoofed page of either M365 or Gmail. The phishing site