Tycoon 2FA Phishers Disperse as Rival Kits Grow and Device-Code Phishing Rises
Summary
After a law-enforcement takedown disabled 330 Tycoon 2FA domains, Barracuda data showed its monthly attack volume falling while rival PhaaS services grew. Researchers also report rising device-code phishing, but its link to the takedown is unclear.
Key points
- A coordinated law-enforcement takedown disabled 330 active Tycoon 2FA domains; Barracuda data showed monthly attack volume falling from more than 9 million to just over 2 million.
- Around the takedown, Mamba 2FA activity rose from nearly 8 million to more than 15 million attacks per month; EvilProxy and Sneaky 2FA activity also increased.
- A Barracuda expert said Tycoon tools, code, and techniques have spread to competing phishing-as-a-service providers.
- Proofpoint and Barracuda observed Tycoon-associated artifacts reused in device-code phishing activity, including a PDF artifact and distinctive source-code comments.
- Device-code phishing tricks victims into using a service’s legitimate new-device login flow to grant attackers account access.
- Proofpoint reported a sharp recent increase in observed device-code phishing, while noting that the extent of any Tycoon user migration to the technique is unclear.
Article Details
- Event Type
- Law enforcement takedown of Tycoon 2FA infrastructure followed by phishing operators’ migration to competing PhaaS providers and increased use of device code phishing.
- Impact
- Law enforcement seized 330 Tycoon 2FA domains. Barracuda data cited in the article shows Tycoon 2FA’s monthly attack volume fell from more than 9 million to just over 2 million. Around the same period, reported monthly volume rose from just under 3 million to just over 4 million for EvilProxy, from under 700,000 to nearly 2 million for Sneaky 2FA, and from nearly 8 million to more than 15 million for Mamba 2FA. Proofpoint reported a recent increase in device code phishing, but the article says it is unclear how much Tycoon 2FA’s user base has shifted to that technique.
People
Merium KhalidDirector of SOC offensive security at Barracuda’s office of the CTO; described the persistence of Tycoon 2FA’s infrastructure, tactics, techniques, and code after the takedown.Selena LarsonSenior threat intelligence analyst at Proofpoint; discussed observed growth in device code phishing and possible reuse of Tycoon-related phishing artifacts.
Threat Actors
EvilProxyIdentified as a competing phishing service provider that reportedly gained activity after the Tycoon 2FA takedown; its monthly attack volume rose from just under 3 million to just over 4 million, according to the article.Mamba 2FAIdentified as a competing phishing service provider that reportedly gained activity after the Tycoon 2FA takedown; Barracuda data cited in the article shows its monthly attack volume rose from nearly 8 million to more than 15 million.Sneaky 2FAIdentified as a competing phishing service provider that reportedly gained activity after the Tycoon 2FA takedown; its monthly attack volume rose from under 700,000 to nearly 2 million, according to the article.Tycoon 2FAIdentified in the article as a phishing-as-a-service group whose infrastructure was targeted in a coordinated law enforcement takedown; its reported monthly attack output declined after 330 active domains were seized.