Security News Threat actors use Tycoon 2FA kits to target MS 365 and Gmail accounts

[vtqhtr413]

Content source

https://windowsreport.com/threat-actors-use-tycoon-2fa-kits-to-steal-your-data-via-fake-login-pages/

Hackers use the phishing-as-a-service (PAAS) platform known as Tycoon 2FA to target Microsoft 365 and Gmail accounts. Their method bypasses two-factor authentication (2FA) systems. Also, the PAAS tool is similar to other Adversary-in-The-Middle (AiTM) phishing platforms such as Dadsec OTT. Thus, cyber security specialists believe that cybercriminals reuse the code.

The Tycoon 2FA quickly became one of the most widespread AiTM phishing kits. As a result, more than a thousand domains are using it. Unfortunately, cybercriminals worked fast and updated their tool to a new version that enhances its obfuscation and anti-detection capabilities. Also, they added a feature that changes network traffic patterns.

Threat actors who use Tycoon 2FA send fake emails with embedded URLs or QR codes. By accessing them, you will get to a security challenge. After completion, they will extract your email address from the URL. Then, you will be redirected to a fake login page. Once you log in, you will encounter a fake two-factor authentication. From there, the hackers will get access to bypass security measures and steal your data.

Threat actors use Tycoon 2FA kits to steal your data via fake login pages

Threat actors use a new Tycoon 2FA kit to bypass two-factor authentication services and steal your Microsoft 365 and Gmail login details.

windowsreport.com

 

[Practical Response]

@Shadowra @Jonny Quest

Never mind the good habits test, the hackers just bypassed malware in the desktop with some good ole fashion social engineering

The fear the title bestows, that good habits alone would squash.

 

[TairikuOkami]

you will be redirected to a fake login page

So even we exclude AV, DNS, anti-phishing protection, there is a simple password manager, which auto-fills data only on a proper domain.

 

[vtqhtr413]

So even we exclude AV, DNS, anti-phishing protection, there is a simple password manager, which auto-fills data only on a proper domain.

It is a deflating story, I agree, it's not my intention to sadden or scare anyone with these posts, it's just the reality of our day. Like an old member here used to say 'Stay Frosty', which means, never let your guard down