#tycoon2fa — Public Fediverse posts

DOUBLOON DREDGER impersonates executives on Notion to trick employees into surrendering auth tokens via EvilTokens, linked to the Tycoon2FA phishing kit.

#DOUBLOONDREDGER #Notion #EvilTokens #Tycoon2FA #Phishing

https://meterpreter.org/doubloon-dredger-notion-phishing-eviltokens/?utm_source=mastodon&utm_medium=jetpack_social

Notion Abused to Harvest Authentication Tokens in Targeted Attacks

Researchers uncovered a sneaky phishing campaign where attackers abused Notion to steal authentication tokens, using free accounts to impersonate senior executives and send legit-looking document-sharing notifications. This clever tactic was linked to two phishing-as-a-service platforms and over 600 malicious scripts.

https://osintsights.com/notion-abused-to-harvest-authentication-tokens-in-targeted-attacks?utm_source=mastodon&utm_medium=social

#Phishingasaservice #Eviltokens #Tycoon2fa #CollaborationPlatformAbuse #Notion

Email threat landscape: Q2 2026 trends and insights - https://www.redpacketsecurity.com/email-threat-landscape-q2-2026-trends-and-insights/

#threatintel
#email-threat-landscape
#q2-2026-trends
#phishing
#tycoon2fa
#microsoft-threat-intelligence

Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
#Tycoon2FA
https://www.elastic.co/security-labs/tycoon-2fa-aitm-detection-engineering

Email threat landscape: Q1 2026 trends and insights - https://www.redpacketsecurity.com/email-threat-landscape-q1-2026-trends-and-insights/

#threatintel
#Email threat landscape
#Phishing campaigns
#Tycoon2FA AiTM
#QR code phishing
#Business email compromise

📬 LeakBase und Tycoon 2FA abgeschaltet: Doppelschlag gegen Cybercrime-Lieferkette
#DarkCommerce #Cybercrime #CybercrimePlattformen #Datenleaks #europol #LeakBase #MehrfaktorAuthentifizierung #Phishing #PhishingasaService #Tycoon2FA https://sc.tarnkappe.info/e2c626

🎣 Authorities have seized over 300 domains and dismantled the #Tycoon2FA phishing kit used by attackers to bypass MFA in targeted attacks against businesses.

Read: https://hackread.com/tycoon-2fa-phishing-platform-shut-down-bypass-mfa/

#CyberSecurity #CyberCrime #Phishing #Scam

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale - https://www.redpacketsecurity.com/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/

#threatintel
#tycoon2fa
#aitm
#phishing
#mfa
#cybercrime

Europäische Strafverfolger zerschlagen #Phishing-Plattform | heise online https://www.heise.de/news/Europaeische-Strafverfolgungsbehoerden-zerschlagen-Phishing-Plattform-11199550.html #CyberCrime #Tycoon2FA

Disruption targets Tycoon 2FA, popular AiTM PhaaS
#Tycoon2FA
https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-tycoon-2fa-popular-aitm-phaas

🥂 🍾 Tycoon down!

"Global phishing-as-a-service platform taken down in coordinated public-private action"

A major phishing-as-a-service platform used to bypass multi-factor authentication (MFA) and enable large-scale account compromise has been disrupted following a coordinated international operation supported by Europol.

The service, known as Tycoon 2FA, provided cybercriminals with a subscription-based toolkit designed to intercept live authentication sessions and gain unauthorised access to online accounts, including those protected by additional security layers."
👇
https://www.europol.europa.eu/media-press/newsroom/news/global-phishing-service-platform-taken-down-in-coordinated-public-private-action

"Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations"
👇
https://www.trendmicro.com/en_us/research/26/c/tycoon2fa-takedown.html

#CyberVeille #Tycoon2FA #Europol

Phishing actors exploit complex routing and misconfigurations to spoof domains - https://www.redpacketsecurity.com/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/

#threatintel
#phishing
#spoofing
#AiTM
#Tycoon2FA
#email-security

Anatomy of Tycoon 2FA Phishing: Tactics Targeting M365 and Gmail https://gbhackers.com/tycoon-2fa-phishing/ #CyberSecurityNews #cybersecurity #Tycoon2FA #Phishing #Gmail

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing
#Tycoon2FA
https://www.proofpoint.com/us/blog/threat-insight/microsoft-oauth-app-impersonation-campaign-leads-mfa-phishing

Global analysis of Adversary-in-the-Middle phishing threats
#EvilProxy #Storm_1167 #DadsecOTT #Rockstar2FA #Mamba2FA #Tycoon2FA #NakedPages #CEPHAS
https://blog.sekoia.io/global-analysis-of-adversary-in-the-middle-phishing-threats/

🎣 Leveraging our telemetry and proactive hunting, we ranked the most widespread AitM phishing kits - #Tycoon2FA, #Storm1167, #NakedPages, #Sneaky2FA, and more.

Additionally, the article includes summary sheets covering 11 AitM phishing kits.

Phishing-as-a-service is an area that is increasing rapidly according to research by security vendor Barracuda Networks, which says it has detected a “massive spike” in PhaaS attacks in the first two months of this year.

https://www.computing.co.uk/news/2025/security/massive-spike-in-phishing-as-a-service-attacks-in-2025-research

#phishing #phaas #tycoon2fa #evilproxy #infosec #cybersecurity #barracuda #technews

Ah! Found the tool used to do this Javascript obfuscation method.

https://benjaminaster.com/invisible-javascript/

Ran into this while digging at a new obfuscation method in use by #Tycoon2FA . The new method uses the following tool by the same author (@martinkleppe) as JSFuck.

https://aem1k.com/invisible/encoder/

Researchers Uncover Phishing-As-A-Service Domains Associated With Tycoon 2FA https://gbhackers.com/phishing-service-tycoon-2fa/ #PhishingasaService(PhaaS) #CybersecurityThreats #CyberSecurityNews #Tycoon2FA #Phishing #Malware