cyber.hendryadrian.com
Security News · securityweek.com

Tycoon 2FA Loses Lead as Phishing-Kit Attacks Surge After Disruption

· Original article ↗

Summary

After 330 Tycoon 2FA domains were seized, attackers shifted to other phishing kits, and attacks involving four platforms rose from about 20 million to over 23 million, Barracuda reports.

Key points

  • A coordinated operation seized 330 active Tycoon 2FA domains in early March, but the platform's operations continued.
  • Barracuda says attackers have shifted to Mamba 2FA, EvilProxy and Sneaky 2FA; Tycoon is no longer the leading kit by Barracuda detections.
  • Attacks involving Tycoon 2FA and the three other kits rose from roughly 20 million to more than 23 million after the disruption.
  • Barracuda says cloned or modified Tycoon attack code and independently hosted deployments remain in circulation.
  • The report describes phishing-kit tools as increasingly reusable and says residual infrastructure and redundancy make the ecosystem harder to disrupt and detect.

Article Details

Event Type
Disruption and migration across phishing-as-a-service platforms following the seizure of Tycoon 2FA domains
Impact
A coordinated operation seized 330 active Tycoon 2FA domains in early March, but Barracuda says the platform's operations continued and threat actors shifted to Mamba 2FA, EvilProxy, and Sneaky 2FA. Barracuda reports that attacks leveraging the four kits rose from roughly 20 million to more than 23 million after the disruption. Tycoon 2FA had previously accounted for 62% of phishing attempts seen by Microsoft and 89% of the PhaaS market, according to the article.

MITRE ATT&CK

T1566 · PhishingThe article says Tycoon 2FA enables threat actors to launch phishing attacks.

Vendors

BarracudaThreat actors have migrated to other phishing-as-a-service (PhaaS) platforms after Tycoon 2FA’s disruption and are reusing its tools, cybersecurity firm Barracuda Networks says.MicrosoftLast year, Tycoon 2FA accounted for 62% of the phishing attempts seen by Microsoft, and was the most used PhaaS platform, with 89% market share, Barracuda says.

Products

EvilProxyAccording to the fresh Barracuda report, despite the rebound, Tycoon 2FA lost the PhaaS crown, as threat actors have migrated to other platforms, such as Mamba 2FA, EvilProxy, and Sneaky 2FA.Mamba 2FAAccording to the fresh Barracuda report, despite the rebound, Tycoon 2FA lost the PhaaS crown, as threat actors have migrated to other platforms, such as Mamba 2FA, EvilProxy, and Sneaky 2FA.Sneaky 2FAAccording to the fresh Barracuda report, despite the rebound, Tycoon 2FA lost the PhaaS crown, as threat actors have migrated to other platforms, such as Mamba 2FA, EvilProxy, and Sneaky 2FA.Tycoon2FAThreat actors have migrated to other phishing-as-a-service (PhaaS) platforms after Tycoon 2FA’s disruption and are reusing its tools, cybersecurity firm Barracuda Networks says.

Related Articles