Tycoon 2FA Operators Pivot to ProxyLine After Infrastructure Takedown
Summary
eSentire's TRU reports that Tycoon 2FA operators shifted authentication infrastructure after a global takedown while retaining the same phishing kit. Observed tactics include proxy rotation, geolocation-based evasion, and WebSocket capture of credentials and 2FA tokens.
Key points
- Entra ID sign-in telemetry showed post-takedown activity shifting to new ASNs, with continued use of AS9009 and heavy reliance on ProxyLine for rotating source IPs.
- Source-code comparisons found no significant changes to the kit's AES encryption, anti-debugging, or domain-validation logic.
- In Gmail-targeted campaigns, WebSocket communication enabled real-time credential harvesting and immediate 2FA token capture and relay.
- Phishing pages used IP and ASN checks to redirect some security vendors and cloud-provider visitors to legitimate websites, concealing phishing content.
- The persistent OfficeHome Application ID and axios user-agent patterns remained useful detection signals despite infrastructure changes.
- eSentire provided a KQL hunting query and recommended monitoring unusual sign-ins, enforcing device-compliance policies, limiting mailbox-rule permissions, and disabling external auto-forwarding.
Article Details
- Attack Vectors
- Tycoon 2FA phishing pages target Microsoft 365 and Gmail users, harvesting credentials and bypassing 2FA to capture session cookies.
- Gmail-targeted campaigns use WebSocket communication for real-time credential and 2FA-token capture and relay.
- Operators use ProxyLine and changing ASN-based authentication sources to rotate exit IPs and evade IP- and geolocation-based detection.
- Phishing pages query IP-intelligence and geolocation services to identify visitors and redirect traffic from selected security, cloud, or proxy networks to legitimate websites.
- The phishing kit encrypts credentials using AES-CBC with a consistent key and IV, according to the article.
- Defensive Notes
- Use sign-in telemetry to hunt for OfficeHome authentication activity with axios user-agent strings and unusual ASNs or source IPs.
- Implement device-compliance policies to restrict access to compliant devices and disrupt adversary-in-the-middle phishing.
- Use 24/7 managed detection and response with the ability to revoke session tokens and terminate active sessions.
- Conduct phishing and security-awareness training.
- Limit mailbox-rule creation and modification to trusted users or administrators, and disable automatic forwarding to external domains.
- Hunt for MFA-method changes, external forwarding rules, sensitive-email or contact extraction, email redirection, SSO access, and audit-log deletion.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelGmail-targeted campaigns use WebSocket communication to capture and relay credentials and 2FA tokens in real time.T1078 · Valid AccountsThe article says operators capture credentials and session cookies for unauthorized account access.T1090 · ProxyOperators use the commercial proxy service ProxyLine and rotate IPs across ASNs and regions.T1557 · Adversary-in-the-MiddleThe article describes Tycoon 2FA phishing as bypassing 2FA and recommends device-compliance policies to disrupt adversary-in-the-middle phishing.T1566 · PhishingTycoon 2FA phishing pages target Microsoft 365 and Gmail accounts to harvest credentials and bypass 2FA.T1573 · Encrypted ChannelThe phishing kit encrypts credentials using AES-CBC with the same key and IV in the compared versions.
Vendors
GoogleRequests originating from Leaseweb, M247, Cloudflare (AS13335), Google, or Microsoft are redirected to the legitimate Carrefour website, helping conceal the phishing content from security researchers and automatedMicrosoftand bypass MFA (‘Tycoon 2FA is a sophisticated PhaaS kit that enables phishing operators targeting Microsoft 365 and Gmail accounts to bypass 2FA and capture session cookies’)
Products
GmailMFA (‘Tycoon 2FA is a sophisticated PhaaS kit that enables phishing operators targeting Microsoft 365 and Gmail accounts to bypass 2FA and capture session cookies’)Microsoft 365 Apps for Enterpriseand bypass MFA (‘Tycoon 2FA is a sophisticated PhaaS kit that enables phishing operators targeting Microsoft 365 and Gmail accounts to bypass 2FA and capture session cookies’)Microsoft Entra IDObservations in this section are derived from Microsoft Entra ID signâin telemetry, enabling analysis of source infrastructure, user agents, and ASNâlevel patterns.