Rockstar2FA

Reported Context (1)

Sophos reported FlowerStorm in late 2024 as a successor to Rockstar2FA with shared ancestry to the Tycoon/Rockstar lineage, including standardized use of next.php as the harvester filename. CodeStorm AiTM Kit Targets Microsoft 365, Steals MFA and Session Tokens

People (1)

Threat Actors (2)

MITRE ATT&CK (25)

Vendors (3)

Products (13)

Tools (6)

Industries (11)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.