{ "Event": { "analysis": "1", "date": "2026-03-04", "extends_uuid": "", "info": "[Threat Intel] Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale", "protected": false, "publish_timestamp": "1773274381", "published": true, "threat_level_id": "3", "timestamp": "1773274381", "uuid": "9a815d47-d9b7-414a-8ab7-70b3ead27c40", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#fb3bcd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Host Information - T1592\"", "relationship_type": "" }, { "colour": "#77a4ec", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#b25e1b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"", "relationship_type": "" }, { "colour": "#65d24c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#454726", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": "" }, { "colour": "#08221e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"", "relationship_type": "" }, { "colour": "#f6ba8d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Forge Web Credentials - T1606\"", "relationship_type": "" }, { "colour": "#2da3e8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"", "relationship_type": "" }, { "colour": "#71ecdb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#70b0b5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#2e58ce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003f", "local": false, "name": "rectifyq:sub-category=\"tool-profile\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1772708445", "to_ids": false, "type": "link", "uuid": "24a017cc-a266-49b6-8bb7-1160c27b8f79", "value": "https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1772708445", "to_ids": false, "type": "text", "uuid": "3b1214e6-43a2-4a5c-8753-898f38096711", "value": "Tycoon2FA emerged as a prominent phishing-as-a-service platform in August 2023, enabling large-scale campaigns targeting over 500,000 organizations monthly. Developed by Storm-1747, it provided adversary-in-the-middle capabilities to bypass multifactor authentication. The kit allowed impersonation of trusted brands like Microsoft 365 and Gmail, intercepting session cookies and credentials. It employed sophisticated evasion techniques including anti-bot screening, browser fingerprinting, and custom CAPTCHAs. Tycoon2FA's infrastructure evolved to use diverse, short-lived domains and complex redirect chains. Its success stemmed from closely mimicking legitimate authentication processes while covertly intercepting user credentials and session tokens." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1772708445", "to_ids": false, "type": "text", "uuid": "013e8c63-7e90-4ea2-99b8-c74a64b18745", "value": "Name: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale\nAuthor: AlienVault\nAdversary: Storm-1747\nTags: [\"session token interception\", \"evasion techniques\", \"credential theft\", \"tycoon2fa\", \"phishing-as-a-service\", \"multifactor authentication bypass\", \"adversary-in-the-middle\"]\nTgtd countries: []\nMlwr families: [\"Tycoon2FA\"]\nAttack_ids: [\"T1592\", \"T1114\", \"T1140\", \"T1550\", \"T1589\", \"T1185\", \"T1087\", \"T1059\", \"T1584\", \"T1528\", \"T1606\", \"T1590\", \"T1098\", \"T1566\", \"T1110\", \"T1078\", \"T1056\"]\nIndustries: [\"Education\", \"Healthcare\", \"Finance\", \"Government\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1772708445", "to_ids": false, "type": "threat-actor", "uuid": "478cf339-3509-4e0d-a613-dc0cc5889ba4", "value": "Storm-1747" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269194", "to_ids": true, "type": "url", "uuid": "01bbd9dd-14f0-4997-8213-4a65d5e014af", "value": "https://immutable.nathacha.digital/T@uWhi6jqZQH7/#?EMAIL_ADDRESS", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269215", "to_ids": true, "type": "url", "uuid": "b3d52fa7-f61e-47af-8527-7d006bbc1c5a", "value": "https://astro.thorousha.ru/vojd4e50fw4o!g/$ENCODED", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269237", "to_ids": true, "type": "url", "uuid": "75a50d57-a1cd-4d1d-a350-76bf51f1e9ba", "value": "https://backend.vmfuiojitnlb.es/CGyP9!CbhSU22YT2/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269258", "to_ids": true, "type": "url", "uuid": "da6a9e6e-eb1e-4457-9ea1-cf345a7bb8dd", "value": "https://kzagniw.es/LI6vGlx7@1wPztdy", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269280", "to_ids": true, "type": "url", "uuid": "d990cede-eb89-4705-823f-6f08e1cb3c1d", "value": "https://mock.zuyistoo.today/pry1r75TisN5S@8yDDQI/$EMAIL_ADDRESS", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269301", "to_ids": true, "type": "url", "uuid": "16c22360-f3a4-4877-ad75-8eb06b13b589", "value": "https://mysql.vecedoo.online/JB5ow79@fKst02/#EMAIL_ADDRESS", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269322", "to_ids": true, "type": "url", "uuid": "7b6cf2e5-dc1d-47ae-910b-af87eb7d0164", "value": "https://piwf.ariitdc.es/kv2gVMHLZ@dNeXt/$EMAIL_ADDRESS", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269345", "to_ids": true, "type": "url", "uuid": "0cc6e888-cefc-43d5-a8e2-a4b0f4085031", "value": "https://q9y3.efwzxgd.es/MEaap8nZG5A@c8T/*EMAIL_ADDRESS", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269366", "to_ids": true, "type": "url", "uuid": "4c21b0ab-5337-4a29-970e-56f3a8f8e45b", "value": "https://qonnfp.wnrathttb.ru/Fe2yiyoKvg3YTfV!/$EMAIL_ADDRESS", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269387", "to_ids": true, "type": "domain", "uuid": "70f1d943-1e7e-45db-ab8b-61995535066a", "value": "kzagniw.es", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269408", "to_ids": true, "type": "hostname", "uuid": "61d12224-2209-4e95-a853-b3f5146c6906", "value": "astro.thorousha.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269430", "to_ids": true, "type": "hostname", "uuid": "19ac7a60-12d7-40e3-a396-b64df7efcd22", "value": "backend.vmfuiojitnlb.es", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269451", "to_ids": true, "type": "hostname", "uuid": "59b544bb-e6cd-4097-a3a0-7bbf217278e0", "value": "immutable.nathacha.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269472", "to_ids": true, "type": "hostname", "uuid": "d3779a61-5447-441a-96dd-eff2c5a46680", "value": "mock.zuyistoo.today", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269494", "to_ids": true, "type": "hostname", "uuid": "428ae0a2-2f9c-4eab-b35a-4d12f3a29e2e", "value": "mysql.vecedoo.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269515", "to_ids": true, "type": "hostname", "uuid": "d5c241be-3d85-4f04-a11b-598e4d3ba10a", "value": "piwf.ariitdc.es", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269536", "to_ids": true, "type": "hostname", "uuid": "381e2ba9-c040-48e8-ac25-d3fab0bec820", "value": "q9y3.efwzxgd.es", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269558", "to_ids": true, "type": "hostname", "uuid": "98192320-649c-4d03-8869-1b4b308a40d5", "value": "qonnfp.wnrathttb.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269579", "to_ids": true, "type": "url", "uuid": "5ccbe9c5-c801-415a-b92e-c9f6636a89d8", "value": "https://qonnfp.wnrathttb.ru/Fe2yiyoKvg3YTfV!/", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269600", "to_ids": true, "type": "url", "uuid": "cbcd539c-3a9d-412d-bc16-03ea6b093660", "value": "https://piwf.ariitdc.es/kv2gVMHLZ@dNeXt/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269621", "to_ids": true, "type": "url", "uuid": "4d37e636-56a1-44c5-b813-65c26eb9fe62", "value": "https://q9y3.efwzxgd.es/MEaap8nZG5A@c8T/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269642", "to_ids": true, "type": "url", "uuid": "0f391ad6-bf3c-4ec5-b82d-c316aa678edd", "value": "https://immutable.nathacha.digital/T@uWhi6jqZQH7/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269663", "to_ids": true, "type": "url", "uuid": "ab9f1dc6-efed-44f1-ae72-2891f7e3d0fc", "value": "https://mock.zuyistoo.today/pry1r75TisN5S@8yDDQI/", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269685", "to_ids": true, "type": "url", "uuid": "86621dc3-22d7-4819-a673-cc2022883ac2", "value": "https://astro.thorousha.ru/vojd4e50fw4o!g/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269706", "to_ids": true, "type": "url", "uuid": "714bc8ea-d430-47f2-9482-4debaff1afe1", "value": "https://branch.cricomai.sa.com/b@GrBOPttIrJA/", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269727", "to_ids": true, "type": "url", "uuid": "2f03eb8e-ae91-4473-9add-5bfc1503c071", "value": "https://mysql.vecedoo.online/JB5ow79@fKst02/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269749", "to_ids": true, "type": "url", "uuid": "329b8fe4-e82e-47bb-9617-bfa7f2011321", "value": "https://qonnfp.wnrathttb.ru/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269770", "to_ids": true, "type": "url", "uuid": "b7bab3c7-e3e9-458e-8856-8d67511b0d32", "value": "https://piwf.ariitdc.es/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269793", "to_ids": true, "type": "url", "uuid": "90311a18-7396-4fc0-89c0-98af5c6f10ef", "value": "https://q9y3.efwzxgd.es/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269814", "to_ids": true, "type": "url", "uuid": "c81597f3-ecbc-464f-9ba0-4ed180021a9d", "value": "https://kzagniw.es/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269836", "to_ids": true, "type": "url", "uuid": "af1ace13-ed4e-4cb5-a9e8-dac2d12335e8", "value": "https://immutable.nathacha.digital/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269857", "to_ids": true, "type": "url", "uuid": "da0887c0-a267-42cd-a0d7-2aba65e0465c", "value": "https://mock.zuyistoo.today/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269878", "to_ids": true, "type": "url", "uuid": "567ad630-8db4-44cb-b2a4-d6b6ff20addf", "value": "https://astro.thorousha.ru/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269899", "to_ids": true, "type": "url", "uuid": "043e0e8f-403e-4840-a0c3-f988284d5f81", "value": "https://branch.cricomai.sa.com/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269921", "to_ids": true, "type": "url", "uuid": "8c7402ed-b396-4c53-b30f-160973a0fac6", "value": "https://mysql.vecedoo.online/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1773269942", "to_ids": true, "type": "url", "uuid": "4643bf9f-94cd-48c8-976e-c4f4d647d6fe", "value": "https://backend.vmfuiojitnlb.es/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }