tycoon

Threat actors have migrated to other phishing-as-a-service (PhaaS) platforms after Tycoon 2FA’s disruption and are reusing its tools, cybersecurity firm Barracuda Networks says. Active since at least 2023, Tycoon 2FA allows threat actors to launch phishing attacks, bypass two-factor authentication, and compromise user accounts. It has been used in attacks against half a million organizations. Last year, Tycoon 2FA accounted for 62% of the phishing attempts seen by Microsoft, and was the most used PhaaS platform, with 89% market share, Barracuda says. In early March, a coordinated effort resulted in the seizure of 330 active Tycoon 2FA domains, but the platform’s operations continued seemingly unaffected. According to the fresh Barracuda report, despite the rebound, Tycoon 2FA lost the PhaaS crown, as threat actors have migrated to other platforms, such as Mamba 2FA, EvilProxy, and Sneaky 2FA. The overall number of attacks leveraging these four phishing kits has increased following the disruption, from roughly 20 million to over 23 million, but Tycoon is no longer the leader as it was prior to the law enforcement operation. It’s now well behind Mamba and EvilProxy based on Barracuda detections. Tycoon 2FA, Barracuda says, absorbed the hit, the underlying ecosystem lived on, and other phishing kits have matured their infrastructure and expanded their offerings with tools previously used by the disrupted service. “Tycoon 2FA was widely used by independent affiliates. This means that variants of Tycoon 2FA’s attack code that have been cloned or modified by individual adversaries continue circulating. It also means that independently hosted deployments remain active and that fragmented, low-volume campaigns persist,” Barracuda notes. According to the cybersecurity firm, PhaaS toolsets are increasingly similar to open source software, where threat actors reuse, modify, and redeploy the code. Combined with residual infrastructure, built-in redundancy to survive disruptions, and persistent access to compromised environments, this makes phishing kits sturdier and more difficult to detect and tackle. According to Barracuda, these artifacts reflect an ecosystem diversification, where Tycoon 2FA is redistributed across more platforms rather than restored. “This does not mean the takedown operation failed. Rather, it shows what happens when disruption hits a maturing underground economy, and why security defenses need to look more broadly than individual players,” Barracuda notes. Related: 53 DDoS Domains Taken Down by Law Enforcement Related: US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: 1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

In embracing device code phishing, attackers trick victims into handing over account access by using a service's legitimate new-device login flow.

A variety of AI-powered app builders promise to bring your ideas to life quickly and effortlessly. Unfortunately, we know exactly who’s always on the lookout for new ideas to bring to life — mostly because we’re rather good at spotting and blocking their old ones. We’re talking about phishers, of course. Recently, we discovered they’ve added a new trick to their arsenal: generating websites using the Bubble AI-powered web-app builder. It’s highly likely that this tactic is now available through one or more phishing-as-a-service platforms, which virtually guarantees these decoys will start appearing in a wide range of attacks. But let’s break this down step-by-step. Why are phishers using Bubble? Including a direct link to a phishing site in an email is a one-way ticket to failure. There’s a high probability the message won’t even reach its destination, as security filters will likely block it before a user ever sees it. Similarly, using automated redirects has long been a major red flag for modern security solutions. What about QR codes? While having a victim scan a code with their phone instead of clicking a link might work in theory, phishers inevitably lose traffic at that step — not everyone is willing to enter corporate credentials on a personal device. This is where automated code-generation services come to the rescue for the cybercriminals. Bubble positions itself as a no-code platform for developing web and mobile applications. Essentially, a user describes what they need through a visual interface, and the platform generates a finished solution. Phishers have adopted this technology to create web apps whose addresses they then embed in their phishing emails. While the actual function of these apps boils down to the same old automated redirect to a malicious site, there are a couple of specific nuances at play. First, the resulting web application is hosted directly on the platform’s servers. The URL ready for use in a phishing email looks something like https://%name%.bubble.io/. From the perspective of security solutions, this appears to be a legitimate, long-standing site. Second, the code for this web application doesn’t look like a typical redirect. To be honest, it’s hard to say what it looks like. The code generated by this no-code platform is a massive jumble of JavaScript and isolated Shadow DOM (Document Object Model) structures. Even for an expert, it’s difficult to grasp what’s happening at first glance; you really have to dig through it to understand how it all works and what the purpose is. Automated web-code analysis algorithms are even more likely to get tripped up, frequently reaching the verdict that this is just a functional, useful site. What are these phishing platforms, and what is the end goal? Today’s phishers rarely develop and implement new tricks from scratch. Most use phishing kits — essentially DIY builders for launching fraudulent schemes — or even full-scale phishing-as-a-service platforms. These platforms provide attackers with a sophisticated (and highly frustrating) toolkit that’s constantly evolving to improve email delivery and bypass anti-phishing defenses. For example, these tools allow attackers, among many other things, to do the following: intercept session cookies; conduct phishing through Google Tasks (a tactic we covered in a previous post); execute adversary-in-the-middle (AiTM) attacks to validate two-factor authentication (2FA) and bypass it in real time; create phishing sites equipped with honeypots and geofencing to hide from security crawlers; and use AI assistants to generate unique phishing emails. To make matters worse, the infrastructure for these platforms is usually hosted on perfectly legitimate services like AWS, making their tactics even harder to spot. The same platforms are used to make the final destination page that harvests credentials. In this specific case, the web app hosted on Bubble redirects victims to a site — complete with a Cloudflare verification check — that mimics a Microsoft sign-in window. Apparently, in the attackers’ parallel universe, Skype is still a viable communication tool, but otherwise, the site looks remarkably convincing. How to protect your company from sophisticated phishing attacks In today’s digital landscape, employees need to clearly understand that corporate credentials should only be entered on services and websites that undeniably belong to the company. You can raise your team’s awareness of modern cyberthreats using Kaspersky Automated Security Awareness Platform for online training. Of course, even the most cautious employee might occasionally take the bait. We recommend equipping all internet-connected workstations with robust security solutions that’ll simply block any attempt to visit a malicious site. Finally, to cut down on the number of dangerous emails cluttering up corporate inboxes in the first place, we suggest deploying a gateway security product with advanced anti-phishing technologies.

Medical technology giant Stryker has shared an update regarding its investigation into the recent Iran-linked cyberattack, revealing that a malicious file used by the attackers has been identified. The Stryker incident came to light on March 11, with the hacker group Handala taking credit for the attack. Handala, widely believed to be a hacktivist persona controlled by Iran’s Ministry of Intelligence and Security (MOIS), claimed to have wiped more than 200,000 devices, forcing Stryker to shut down offices in dozens of countries. Some early reports indicated that Handala used wiper malware in the attack — the group has been known to use such malware — but Stryker said it found no evidence of malware or ransomware being deployed on its systems. The most likely scenario based on the evidence available to date is that the hackers wiped systems by abusing Stryker’s Microsoft Intune instance, which is used to remotely manage desktop and mobile endpoints and applications within the organization. There is some indication that Handala leveraged credentials obtained via infostealer malware to gain access. Stryker said the incident disrupted order processing, manufacturing, and shipping. In a statement issued on Monday, the company said it has made “meaningful progress” in restoring impacted systems. For the first time, the company has also shared some technical information from the investigation into the incident. “Early in our investigation, we believed there was no indication of ransomware or malware,” Stryker said. “Further into the course of our investigation, alongside Palo Alto Networks Unit 42 and other experts, we identified that the threat actor used a malicious file to run commands which allowed them to hide their activity while in our systems.” It added, “To be clear, this file was not capable of spreading — either inside or outside of our environment. Most importantly, at no point has our investigation identified malicious activity directed towards our customers, suppliers, vendors or partners.” Based on this brief description, the malicious file mentioned by Stryker may have been a small custom binary or script rather than actual malware. However, this shows that the hackers deployed their own tools on the compromised systems and did not rely solely on existing software to carry out their activities. In addition to sharing updates on its investigation and restoration efforts, Stryker has made public an assessment from Palo Alto Networks to show that the incident has been contained. The US government has officially linked Handala to Iran’s MOIS and has taken down several websites used by the threat actor. In addition, the FBI has issued an alert sharing information about attacks allegedly carried out by MOIS threat actors such as Handala, including the malware they use. “FBI obtained malware samples through investigations. The samples were categorized as masquerading malware (stage 1), persistent implant (stage 2), and related stage 2 malware that contained additional or unique functions. Stage 1 usually masqueraded as commonly used applications like Pictory, KeePass, and Telegram and contained the binaries for the next stage of malware. The persistent implant malware spawned following the masquerading malware’s execution and possible user interaction with the malicious application. At this stage, the Iran MOIS cyber actors configured a command and control (C2) using a Telegram bot, allowing bidirectional communication between the compromised device and api.telegram[.]org. FBI considered the masquerading malware and persistent implant to be core functionality for the malware campaign.” Stryker has confirmed that it is working with US government agencies in its investigation of the incident, but the malware described in the FBI alert is unlikely to be related to the attack on the medtech company if indeed no malware was involved. Related: Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability Related: Tycoon 2FA Fully Operational Despite Law Enforcement Takedown

The phishing-as-a-service (PhaaS) platform Tycoon 2FA’s operation has continued despite an international effort to disrupt it, CrowdStrike reports. A subscription-based service active since 2023, Tycoon 2FA allows miscreants to mount phishing attacks, bypass multi-factor authentication (MFA), and compromise accounts without triggering alerts. Responsible for 62% of the phishing attempts blocked by Microsoft in 2025, Tycoon 2FA has been used to generate over 30 million malicious emails monthly, targeting half a million organizations. The platform has been linked to roughly 96,000 distinct phishing victims worldwide. In early March, Europol and Microsoft announced the seizure of 330 active Tycoon 2FA domains and legal action against multiple individuals linked to the PhaaS, as part of an international effort involving law enforcement agencies in six countries and a dozen private companies. According to CrowdStrike, the takedown effort left only a minor dent in Tycoon 2FA’s operations, which are now back to pre-disruption levels. On March 4 and 5, following the law enforcement operation, Tycoon 2FA activity volume dropped to roughly 25%, but returned to previous levels shortly after, with “daily levels of cloud compromise active remediations returning to early 2026 levels”, CrowdStrike says. “Additionally, Tycoon2FA’s TTPs have not changed following the takedown, indicating that the service’s operations may persist beyond this disruption,” the cybersecurity firm notes. These TTPs include phishing emails directing to malicious CAPTCHA pages, session cookie theft upon CAPTCHA validation, use of JavaScript files for email address extraction, credential proxying via malicious JavaScript files, and use of stolen credentials to access the victims’ cloud environments. In March, CrowdStrike says, Tycoon 2FA has been used for business email compromise (BEC) phishing, email thread hijacking, SharePoint and cloud compromise for phishing URL distribution, and in cloud account takeover attacks. CrowdStrike observed failed Tycoon 2FA attacks after the phishing pages were suspended, identified eight IP addresses likely acquired after the takedown operation, and identified phishing domains used since 2025 that were not targeted by the law enforcement operation. While Tycoon 2FA likely began recovering the same day Europol and Microsoft announced the takedown, domains associated with the Salty 2FA phishing kit appear to have been affected by the disruption. “The efforts by Europol and private industry partners to degrade the operations of Tycoon 2FA will likely have a positive impact on the eCrime landscape overall, even if temporary. The service’s disruption likely set back current customers of the service by impeding phishing operations and damaged the long-term reputation of the PhaaS provider in the crimeware landscape,” CrowdStrike notes. Related: US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown

The United States government has for the first time officially linked the notorious Handala hacker group to the Iranian government. The announcement came amid the takedown of several websites used by Handala. Handala has been on the radar of cybersecurity firms for years, but it gained widespread attention in recent days after ramping up its activity following the start of the US-Israel-Iran conflict. Handala has allegedly launched many attacks against Israel, including wiping military weather servers, hijacking security camera feeds, exfiltrating and deleting corporate data, publicly exposing details of intelligence personnel, and compromising an oil and gas exploration firm. However, its best-known attack targeted the US-based medical technology giant Stryker, causing significant disruption after wiping thousands of its systems. Handala portrays itself as a pro-Palestinian hacktivist group motivated by anti-Israeli ideology. The cybersecurity community, however, widely regards it as a cover for Void Manticore, an Iranian state-sponsored threat actor believed to operate under the direction of Iran’s Ministry of Intelligence and Security (MOIS). The Justice Department has now confirmed the connection between Handala and Iran’s MOIS, after it took down four websites used by the hacker group for psychological operations. Specifically, authorities seized four domains: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to. The Justice Department said Iran’s MOIS used the seized websites “in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons”. An X account used by the hacker group was also suspended in recent days. The US Department of State is offering a reward of up to $10 million for information on foreign hackers who target critical infrastructure. Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

The US Justice Department on Thursday announced the results of an international operation to disrupt several IoT botnets used by threat actors to launch distributed denial-of-service (DDoS) attacks. The operation targeted the Aisuru, Kimwolf, JackSkid, and Mossad botnets and involved several major cybersecurity and tech companies, as well as law enforcement in Germany and Canada. Authorities said the botnets have compromised more than 3 million devices as of March 2026, including DVRs, cameras, Wi-Fi routers, and other IoT devices. Aisuru has made headlines over the past several months for its massive DDoS attacks, including several record-breaking attacks. It is tightly connected to Kimwolf, which is essentially Aisuru’s Android-focused successor. Kimwolf was in the spotlight for abusing residential proxy networks to expand and for ensnaring roughly 2 million devices. Aisuru and Kimwolf were both linked by Cloudflare in February to the largest DDoS attack recorded to date, which peaked at 31.4 Tbps. According to the DoJ, cybercriminals used the Aisuru botnet to issue over 200,000 DDoS attack commands, while Kimwolf issued 25,000 such commands. JackSkid and Mossad are lesser-known botnets, but the DoJ said they issued 90,000 and 1,000 DDoS attack commands, respectively. AWS, which was involved in the takedown, reported that just like Kimwolf, the JackSkid botnet used residential proxy networks to grow. The botnet disruption efforts included seizing multiple internet domains, virtual servers, and other infrastructure used by Aisuru, Kimwolf, JackSkid, and Mossad. The DoJ said law enforcement agencies in Canada and Germany “conducted their own operations targeting botnet administrators and botnet infrastructure”, but did not say whether anyone was arrested. Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

A C-level executive at Swedish exposure management and identity security firm Outpost24 was targeted in a sophisticated phishing attack, though the effort was unsuccessful, the company’s subsidiary Specops Software reports. Specops said the attack was identified early and blocked before it could compromise systems or impact users. However, the security firm has disclosed technical details to highlight its sophistication. The attack, likely mounted with a recently identified phishing-as-a-service kit named Kratos, relied on a seven-step chain that leveraged layered infrastructure and legitimate services to evade detection and deceive the recipient. The phishing message, impersonating financial services provider JP Morgan, appeared as if part of an existing email thread to increase its sense of legitimacy, and invited the recipient to review and sign a document. Furthermore, the attackers used two DomainKeys Identified Mail (DKIM) signatures to ensure the email would pass DMARC authentication and appear trustworthy. Within the message, the attackers included a ‘review document’ link pointing to the legitimate Cisco domain secure-web.cisco.com, which is typically used for rewriting URLs in emails after they have been validated by Cisco. Because the link passed Cisco’s Secure Email Gateway validation, the redirect URL was hosted on Cisco’s infrastructure, further allowing the phishing email to bypass detection systems. The next step in the chain involved a redirection to the legitimate email API platform Nylas, which was likely used to ensure that the phishing link would redirect through Cisco Secure Web infrastructure. “By chaining redirects through legitimate services such as Cisco and Nylas, the attackers increase the likelihood that the link will pass security filtering and reputation checks. These domains are widely trusted and commonly observed in legitimate traffic, which makes automated blocking more difficult,” Specops notes. Next, the target was redirected to a subdomain on the website of a legitimate development company based in India, and then to a domain that was originally registered in 2017 by a Chinese entity. The domain’s previous TLS certificate expired on March 6, the associated DNS records were released shortly after, and the domain was re-registered on March 12, with several new TLS certificates issued for it the same day. “The timing strongly suggests the domain was reacquired and repurposed specifically for this campaign,” Specops notes. The user was redirected once again, this time to phishing infrastructure that was deployed behind Cloudflare to hide its origin server. At this stage, the victim was served a browser validation check, likely meant to prevent security analysis. Finally, the victim would be served a convincing phishing page meant to harvest Microsoft 365 credentials. “Like the rest of the attack chain, this step is also carefully constructed, from a fake loading animation imitating Outlook to a check that validates whether the user input is actually an email. As the final step, the site attempts a legitimate login to verify that the captured credentials are valid,” Specops explains. The cybersecurity firm confirmed to SecurityWeek that the individual targeted in this attack attempt was a C-level executive at its parent company Outpost24, underlining the sophistication of the attack. Specops did not attribute the incident to a specific threat actor but noted that the modus operandi aligns perfectly with that of Iran-linked threat actors that recently targeted various entities in the US. On the other hand, the firm said, other hacking groups have been observed employing similar tactics, and attribution remains elusive. the article has been updated to clarify that the attack was not successful Related: Internet Infrastructure TLD .arpa Abused in Phishing Attacks Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: LastPass Warns of New Phishing Campaign Related: ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing

Law enforcement agencies in the United States and Europe have disrupted SocksEscort, a malicious proxy service that facilitated criminal activities. These proxy services enable users to hide their identity and bypass security systems. In the case of SocksEscort, it has been used for various types of cybercrime, including DDoS attacks, ransomware attacks, and the distribution of child abuse materials. According to Europol and the US Justice Department, SocksEscort has been powered by compromised routers and other IoT devices, with roughly 363,000 IP addresses from 163 countries linked to the cybercrime service since 2020. In February 2026, just before the takedown operation was initiated, SocksEscort was supported by approximately 8,000 hacked routers, including 2,500 in the US. Lumen Technologies, whose Black Lotus Labs assisted the disruption efforts, said “SocksEscort maintained an average size of approximately 20,000 distinct victims weekly, with communications routed through an average of 15 command-and-control nodes.” Authorities estimate that SocksEscort customers paid a total of more than $5.7 million for the proxy service, and US Justice Department data indicates many users profited substantially from it, with some defrauding victims of hundreds of thousands or even $1 million in individual schemes. Europol reported that “law enforcement agencies successfully took down and seized 34 domains as well as 23 servers located in seven countries. In addition, the United States froze a total of USD 3.5 million in cryptocurrency. The infected modems used to offer the proxy service have been disconnected from the service.” The FBI on Thursday issued an alert for the AVrecon malware that has powered the SocksEscort service. The agency said the proxy service’s operators exploited known vulnerabilities in routers and IoT devices to deploy the malware and create a botnet. “SocksEscort uses AVrecon malware to target approximately 1,200 device models manufactured by Cisco, D-Link, Hikvision, MicroTik, Netgear, TP-Link, and Zyxel,” the FBI said. “The vast majority of observed devices infected with AVrecon malware are small-office/home-office (SOHO) routers infected using critical vulnerabilities such as Remote Code Execution (RCE) and command injection.” The agency has shared information on the AVrecon malware’s distribution, execution, persistence, and communication, providing indicators of compromise (IoCs) and recommendations for securing devices. News of the SocksEscort takedown comes shortly after Europol, Microsoft, and cybersecurity companies announced a joint effort to take down the phishing-as-a-service platform Tycoon 2FA. Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: RaccoonO365 Phishing Service Disrupted, Leader Identified Related: 1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

Another week in cybersecurity. Another week of "you've got to be kidding me." Attackers were busy. Defenders were busy. And somewhere in the middle, a whole lot of people had a very bad Monday morning. That's kind of just how it goes now. The good news? There were some actual wins this week. Real ones. The kind where the good guys showed up, did the work, and made a dent. It doesn't always happen, so when it does, it's worth noting. The bad news? For every win, there's a fresh headache waiting right behind it. New tricks, old tricks dressed up in new clothes, and a few things that'll make you want to go touch grass and never log back in. But you will. We all do. So here's everything that mattered this week — the wins, the warnings, and the stuff you really shouldn't ignore. ⚡ Threat of the Week Tycoon 2FA and LeakBase Operations Dismantled — The infrastructure hosting the Tycoon2FA service, which Europol said was among the largest adversary-in-the-middle (AitM) phishing operations worldwide, has been dismantled by a coalition of security companies and law enforcement agencies. "Taking down infrastructure associated with Tycoon 2FA and identifying the individual allegedly responsible for creating this prolific hacking tool will have a significant impact on overall MFA credential phishing, and hopefully strike a blow to the world's most prolific AitM phishing-as-a-service," Proofpoint said in a statement shared with The Hacker News. Phishing kits and PhaaS platforms have become an Achilles' heel in recent years, streamlining and democratizing phishing attacks for less technically savvy hackers by providing them with a suite of tools to create convincing emails and phishing pages that unsuspecting victims will engage with. For a relatively modest fee, aspiring cybercriminals can subscribe to these services and carry out phishing attacks at scale. In a similar development, authorities also took down LeakBase, one of the world's largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. While the disruption is a positive development, it's known that such takedowns typically create only short-term disruptions, as the ecosystem adapts by migrating to other forums or more resilient distribution channels, like Telegram. Shadow AI Is EVERYWHERE. Here's How You Can Find and Secure It Shadow AI is quietly accessing sensitive data across your SaaS environment. Learn how to close AI blind spots and get ahead of data exposure risks with this new guide. Get Answers Now ➝ 🔔 Top News Anthropic Finds 22 Firefox Vulnerabilities in Firefox — Anthropic said it discovered 22 new security vulnerabilities in the Firefox web browser using its Claude Opus 4.6 large language model (LLM)as part of a security partnership with Mozilla. Of these, 14 have been classified as high, seven have been classified as moderate, and one has been rated low in severity. The issues were addressed in Firefox 148, released late last month. The vulnerabilities were identified over a two-week period in January 2026. The company noted that the cost of identifying vulnerabilities is cheaper than creating an exploit for them, and the model is better at finding issues than at exploiting them. Qualcomm Flaw Exploited in the Wild — A high-severity security flaw impacting Qualcomm chips used in Android devices has been exploited in the wild. The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component that could result in memory corruption and arbitrary code execution. There are currently no details on how the vulnerability is being exploited in the wild. However, Google acknowledged in its monthly Android security bulletin that "there are indications that CVE-2026-21385 may be under limited, targeted exploitation." Coruna iOS Exploit Kit Uses 23 Exploits Against Older iOS Devices — Google disclosed details of a new and powerful exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between 13.0 and 17.2.1. The exploit kit featured five full iOS exploit chains and a total of 23 exploits, the company said. What makes it different is that it started with a commercial surveillance vendor in February 2025, got picked up by what seems like a Russian espionage group targeting Ukrainians in July 2025, and ended up in the hands of financially motivated attackers in China going after crypto wallets by the end of the year. Coruna began its life as a surveillance exploit kit, but by the time it reached the Chinese cybercrime gang, it was heavily focused on financial theft. It's not known how the exploit kit got passed between multiple threat actors of varied motivations. This has raised the possibility of a secondhand market where it's resold to other threat actors, who end up repurposing them for their own objectives. Transparent Tribe Unleases Vibeware Against Indian Entities — In a new attack campaign detected by Bitdefender, the Pakistan-aligned threat actor known as Transparent Tribe has leveraged artificial intelligence (AI)-powered coding tools to vibe-code malware and use them to target the Indian government and its embassies in multiple foreign countries. These tools are written in niche programming languages like Nim, Zig, and Crystal so as to evade detection. "Rather than a breakthrough in technical sophistication, we are seeing a transition toward AI-assisted malware industrialization that allows the actor to flood target environments with disposable, polyglot binaries," the company said. Iranian Hackers Target U.S. Entities Amid Conflict — The Iranian hacking group tracked as MuddyWater (aka Seedworm) targeted several U.S. companies, including banks, airports, non-profit, and the Israeli arm of a software company, as part of a campaign that began in early February 2026, and continued after the joint U.S.-Israel military strikes on Iran towards the end of the month. The development comes against the backdrop of hacktivist-fueled cyber attacks, with wiper campaigns targeting Israeli energy, financial, government, and utilities sectors. "The trajectory is clear: what began as nation-state-level ICS capability in 2012 [with Shamoon wiper] has become, by 2026, something any motivated actor can attempt with free tools and an internet connection," CloudSEK said in a report last week. "The technical barrier has collapsed. The threat pool has expanded. And the US attack surface has never been larger." Another targeted campaign has distributed a trojanized version of the Red Alert rocket warning Android app to Israeli users via SMS messages impersonating official Home Front Command communications. Once installed, the malware monitors and abuses the granted permissions to collect sensitive data, including SMS messages, contacts, location data, device accounts, and installed applications. The campaign is believed to be the work of a Hamas-affiliated actor known as Arid Viper. There are currently no details available on the scope of the campaign and whether any of the infections were successful. Acronis said it highlights how trusted emergency services can be weaponized during periods of geopolitical tension using social engineering. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025–64712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE). 🎥 Cybersecurity Webinars Automating Real-World Security Testing to Prove What Actually Works → Running a security test once a year and hoping for the best? That's not a strategy anymore. This webinar shows you how to continuously test your defenses using real attack techniques — so you actually know what holds up and what quietly breaks when no one's looking. When AI Agents Become Your New Attack Surface → AI tools aren't just answering questions anymore — they're browsing the web, hitting APIs, and touching your internal systems. That changes everything about how you think about risk. This webinar breaks down what that means for security, and what you actually need to do before something goes wrong. 📰 Around the Cyber World New AirSnitch Attack Shows Wi-Fi Client Isolation May Not Be Enough — A group of academics has developed a new attack called AirSnitch that breaks the encryption that separates Wi-Fi clients. Xin'an Zhou, the lead author of the research paper, told Ars Technica that AirSnitch bypasses worldwide Wi-Fi encryption and that it "might have the potential to enable advanced cyber attacks." The attack, at its core, leverages three weaknesses in client isolation implementations: (1) It abuses the group key(s) that are shared between all clients in the same Wi-Fi network, (2) It bypasses client isolation by tricking the gateway into forwarding packets to the victim at the IP layer by taking advantage of the fact that many networks only enforce client isolation at the MAC/Ethernet layer, and (3) It allows an adversary to manipulate internal switches and bridges to forward the victim's uplink and downlink traffic to the adversary. As a result, they enable the attacker to restore AitM capabilities even if client isolation protections exist. "We found that Wi-Fi client isolation can often be bypassed," Mathy Vanhoef said. "This allows an attacker who can connect to a network, either as a malicious insider or by connecting to a co-located open network, to attack others." Google Tracked 90 Exploited 0-Days in 2025 — Google said it tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025, up from 78 in 2024 and down from 100 in 2023. "Both the raw number (43) and proportion (48%) of vulnerabilities impacting enterprise technologies reached all-time highs, accounting for almost 50% of total zero-days exploited in 2025," the company said. Of these, vulnerabilities in security and networking appliances made up about half (21) of the enterprise-related zero-days in 2025. Mobile zero-days rebounded from nine in 2024 to 15 in 2025, with commercial surveillance vendors (15, plus likely another three) leading the charge in exploiting zero-day vulnerabilities than state-sponsored cyber espionage groups (12) for the first time. The names of the commercial spyware companies were not disclosed. Microsoft had the largest number of actively exploited flaws at 25, followed by Google (11), Apple (8), Cisco (4), Fortinet (4), Ivanti (3), and Broadcom VMware (3). Memory safety issues accounted for 35% of all exploited zero-day vulnerabilities last year. Financially motivated threat groups, including ransomware gangs, also targeted enterprise technologies and accounted for nine zero-days in 2025, double the five attributed to them in 2024. Velvet Tempest Deploys ClickFix Attack — Velvet Tempest (aka DEV-0504) has been observed using a ClickFix lure, followed by hands-on-keyboard activity consistent with Termite ransomware tradecraft. According to a report by Deception.Pro, the attack used the social engineering technique to drop payloads like DonutLoader and CastleRAT. "Follow-on activity included Active Directory reconnaissance (domain trusts, server discovery, user listing) and attempted browser credential harvesting via a PowerShell script downloaded from 143.198.160[.]37," it said. "Telemetry and infrastructure in this chain align with a modern initial-access playbook: rapid staging, heavy use of living-off-the-land binaries (LOLBins), and long-lived command-and-control (C2) traffic that blends into normal browser noise." No ransomware was deployed in the attack that took place between February 3 and 16, 2026. Ghanaian National Pleads Guilty to Role in $100M Romance Scam — A Ghanaian national pleaded guilty to his role in a massive fraud ring that stole over $100 million from victims across the U.S. through business email compromise attacks and romance scams. 40-year-old Derrick Van Yeboah pleaded guilty to conspiracy to commit wire fraud and agreed to pay more than $10 million in restitution. "Van Yeboah personally perpetrated many of the romance scams by impersonating fake romantic partners in communications with victims," the U.S. Justice Department said. "Many of the conspiracy’s victims were vulnerable older men and women who were tricked into believing that they were in online romantic relationships with persons who were, in fact, fake identities assumed by members of the conspiracy." The conspirators, part of a criminal organization primarily based in Ghana, also committed business email compromises to deceive businesses into wiring funds to the enterprise. In total, the scheme stole and laundered more than $100 million from dozens of victims. After stealing the money, the fraud proceeds were laundered to West Africa. The defendant is scheduled to be sentenced in June 2026. Taiwan Indicts 62 People for Cyber Scams — Prosecutors in Taipei indicted 62 people and 13 companies for their involvement in cyber scam operations organized throughout Asia by the Prince Group. Chen Zhi, the founder of the Prince Group, was indicted by U.S. prosecutors last year on money laundering charges. Taipei prosecutors said those associated with Prince Group laundered at least $339 million into Taiwan and used the stolen funds to buy 24 properties, 35 vehicles, and other assets amounting to approximately $1.7 million. In all, authorities seized about $174 million in cash and assets. Prince Group "effectively controlled 250 offshore companies in 18 countries, holding 453 domestic and international financial accounts. By creating fictitious transaction contracts between these offshore companies, the group laundered money through foreign exchange channels," they added. Ransomware Actors Use AzCopy — Ransomware operators are ditching the usual tools like Rclone for Microsoft's own AzCopy, turning a trusted Azure utility into a stealthy data exfiltration mechanism and blending into normal activity. "The adoption of AzCopy and other familiar tools by attackers represents a similar logic to living-off-the-land in the final and most critical phase of an operation: exfiltrating data out of an organization," Varonis said. "Spinning up an Azure storage account takes minutes and requires only a credit card or compromised credentials. The attacker gains the benefits of Microsoft's global infrastructure while security teams struggle to distinguish between malicious uploads and legitimate traffic." Threat Actors Exploit Critical Flaw in WPEverest Plugin — Threat actors are exploiting a critical security flaw in WPEverest's User Registration & Membership plugin (CVE-2026-1492, CVSS score: 9.8) to create rogue administrator accounts. The vulnerability affects all versions of User Registration & Membership through 5.1.2. The issue has been addressed in version 5.1.3. Wordfence said the plugin is susceptible to improper privilege management, which enables the creation of bogus admin accounts. "This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist," it said. "This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration." MuddyWater Evolves Its Tactics — The Iranian hacking group known as MuddyWater has been observed leveraging Shodan and Nuclei to identify potential vulnerable targets, as well as using subfinder and ffuf to perform enumeration of target web applications. The findings come from an analysis of the threat actor's VPS server hosted in the Netherlands. MuddyWater is also said to be attempting to scan and/or exploit recently disclosed CVEs related to BeyondTrust (CVE-2026-1731), Ivanti (CVE-2026-1281), n8n (CVE-2025-68613), React (CVE-2025-55182), SmarterMail (CVE-2025-52691), Laravel Livewire (CVE-2025-54068), N-Central (CVE-2025-9316), Citrix NetScaler (CVE-2025-5777), Langflow (CVE-2025-34291), and Fortinet (CVE-2024-55591, CVE-2024-23113, CVE-2022-42475), along with SQL injection vulnerabilities in BaSalam and an unspecified Postgres development platform for initial access. One of the custom tools identified in the server is KeyC2, a command-and-control (C2) framework that allows operators to remotely control compromised Windows machines over a custom binary protocol on port 1269 from a Python script. Two C2 tools used by the adversary are PersianC2, which relies on standard HTTP polling to receive commands and files via JSON API endpoints, and ArenaC2, a Python-based program that operates over HTTP POST requests. Also detected is a PowerShell loader that leads to the execution of obfuscated Node.js payloads that appear similar to Tsundere Botnet. The infrastructure is assessed to have been used to target entities in Israel, Egypt, Jordan, the U.A.E., and the U.S. Some aspects of the activity overlap with Operation Olalampo. 2,622 Valid Certificates Exposed — A new study undertaken by Google and GitGuardian found over a million unique private keys leaked across GitHub and Docker Hub, out of which 40,000 were mapped to 140,000 real TLS certificates. "As of September 2025, 2,600 of these certificates were valid, with more than 900 actively protecting Fortune 500 companies, healthcare providers, and government agencies," GitGuardian said. "Our disclosure campaign achieved 97% remediation, but at the cost of 4,300 emails sent, 1,706 entities contacted, 9 bug bounty submissions, countless follow-ups, and days of meticulous attribution work employing multiple OSINT techniques. The high success rate masks the extraordinary effort required to protect organizations that fail to protect themselves." Context7 MCP Server Suffers from ContextCrush — A critical security flaw in Upstash's Context7 MCP Server, a widely used tool for delivering documentation to AI coding assistants, has been discovered. Dubbed ContextCrush, the vulnerability could allow attackers to inject malicious instructions into AI development tools through a trusted documentation channel. Noma Security, which disclosed details of the flaw, said it's rooted within the platform's "Custom Rules" feature, which allows library maintainers to provide AI-specific instructions to help assistants better interpret documentation. "Context7 operates both as the registry, where anyone can publish and manage library documentation, and as the trusted delivery mechanism that pushes content directly into the AI agent's context," security researcher Eli Ainhorn said. "The attacker never needs to reach the victim's machine. Instead, the attacker can plant malicious custom rules in Context7's registry, and Context7’s infrastructure delivers them through the MCP server to the AI agent running in the developer's IDE. As agents are execution machines and run whatever is loaded into their context, all the victim’s agent does is execute the attacker's instructions on the victim’s machine, using its own tool access (Bash, file read/write, network). In this scenario, the agent has no way to distinguish between legitimate documentation and attacker-controlled content because they arrive through the same trusted channel and from the same trusted source." German Court Sentences Key Person Behind Call Center Scam — A German court has sentenced a suspected central figure in the so-called Milton Group call-center fraud network to seven-and-a-half years in prison. Although the court did not publicly name the defendant, court records reviewed by the Organized Crime and Corruption Reporting Project (OCCRP) indicate the person convicted was Mikheil Biniashvili, a citizen of Georgia and Israel. In addition to the prison sentence, the court ordered the confiscation of €2.4 million ($2.8 million) linked to the operation. Between 2017 and 2019, the defendant ran a call-center operation in Albania that used trained agents to persuade victims to invest in fraudulent online trading schemes. The scheme caused losses of about €8 million ($9.4 million) to victims, mostly in German-speaking countries. The operation employed up to 600 people at its peak. Call-center agents allegedly posed as investment advisers, building trust with targets before persuading them to deposit funds into fake trading platforms controlled by the network by promising large investment returns. Biniashvili was arrested in Armenia in 2023 and extradited to Germany in 2024. Multiple Flaws in Avira Internet Security — Three vulnerabilities have been disclosed in Avira Internet Security that could allow for arbitrary file deletion (CVE-2026-27748) in the Software Updater component, an insecure deserialization (CVE-2026-27749) in System Speedup, and an arbitrary folder deletion over TOCTOU (CVE-2026-27748) in the Optimizer. "The file delete primitive is useful on its own," Quarkslab said. "The other two both result in Local Privilege Escalation to SYSTEM." Russian Ransomware Operator Pleads Guilty in U.S. — Evgenii Ptitsyn, a 43-year-old Russian national, has pleaded guilty in a U.S. court to running the Phobos ransomware outfit that targeted more than 1,000 victims globally and extorted ransom payments worth over $39 million. Ptitsyn was extradited from South Korea in November 2024. "Beginning in at least November 2020, Ptitsyn and others conspired to engage in an international computer hacking and extortion scheme that victimized public and private entities through the deployment of Phobos ransomware," the Justice Department said. "As part of the scheme, Ptitsyn and his co-conspirators developed and offered access to Phobos ransomware to other criminals or 'affiliates' to encrypt victims' data and extort ransom payments from victims. The administrators operated a darknet website to coordinate the sale and distribution of Phobos ransomware to co-conspirators and used online monikers to advertise their services on criminal forums and messaging platforms." Ptitsyn faces a maximum penalty of 20 years in prison for wire fraud charges. Fake Google Security Check Leads to RAT — A bogus website resembling the Google Account security page is being used to deliver a Progressive Web App (PWA) capable of harvesting one-time passcodes and cryptocurrency wallet addresses, and proxying attacker traffic through victims' browsers. "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents – all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Phishing Campaign Abuses Google Infrastructure — A new email phishing campaign is leveraging legitimate Google infrastructure to bypass standard security filters. The activity uses Google Cloud Storage (GCS) to host initial phishing URLs that, when clicked, redirect unsuspecting users to a malicious site designed to capture their financial information or deploy malware. "By hosting the initial link on Google's servers, the attackers ensure the email passes authentication checks like SPF and DKIM," security researcher Anurag Gawande said. Client-Side Injection Conducts Ad Fraud — A new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity has been found to overwrite referral tokens to redirect affiliate revenue to unknown threat actors. "A browser extension is injecting obfuscated JavaScript from msclairty[.]com, a typosquatted domain impersonating Microsoft Clarity," c/side's Simon Wijckmans said. "The domain is not serving analytics. It is delivering an obfuscated JavaScript payload that performs affiliate cookie stuffing, tracking cookie deletion, and Fetch API hijacking inside the visitor's browser. This prevents a competing tracking service from recording the real traffic source. The attacker does not just want credit for the visit. They actively block other trackers from capturing any attribution data that would conflict with their fraudulent cookie." The script has affected sites across multiple unrelated sectors, including transportation, SaaS platforms, sports management, and government payment portals. Impacted visitors primarily span Chrome versions 132, 138, and 145, and originate from U.S.-based IP addresses on the East and West coasts. Illinois Man Charged with Hacking Snapchat Accounts to Steal Nudes — U.S. prosecutors have charged a 26-year-old Illinois man, Kyle Svara, with conducting a phishing operation that made it possible to break into the Snapchat accounts of approximately 570 women to steal private photos and sell them online. "From at least May 2020 to February 2021, Svara used social engineering and other resources to collect his targets' emails, phone numbers, and/or Snapchat usernames," the Justice Department said. "He then used those means of identification to access his targets' Snapchat accounts, which prompted Snap Inc. to send account security codes to those women. Using anonymized phone numbers, Svara posed as a representative of Snap Inc. and sent more than 4,500 text messages to hundreds of women, requesting those Snapchat access codes." Svara is alleged to have accessed the Snapchat accounts of at least 59 women without permission to download their nude or semi-nude images and sell them on internet forums. Meta Sued Over AI Smart Glasses' Privacy Concerns — Meta is facing a new class action lawsuit over its AI-powered Ray-Ban Meta glasses, following a report from Swedish newspapers Svenska Dagbladet and Goteborgs-Posten that employees at Kenya-based subcontractor Sama are reviewing intimate, personal footage filmed from customers' glasses. Meta said subcontracted workers might sometimes review content captured by its AI smart glasses for the purpose of improving the "experience," as stated in its Privacy Policy. It also claimed that data is filtered to protect people's privacy. But the investigation found that this step did not always consistently work. "Unless users choose to share media they've captured with Meta or others, that media stays on the user's device," Meta told BBC News. "When people share content with Meta AI, we sometimes use contractors to review this data for the purpose of improving people's experience, as many other companies do." Total Ransomware Payments Stagnated in 2025 — The total ransomware payments in 2025 stagnated, even if the number of attacks increased. According to blockchain analysis firm Chainalysis, total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%. "While aggregate revenue stagnated, the median ransom payment grew 368% year-over-year to nearly $60,000," the company said. "The 2025 total is likely to approach or exceed $900 million as we attribute more events and payments, just as our 2024 total grew from our initial $813 million estimate this time last year." The decline in payment rates from 63% in 2024 to just 29% last year indicates that fewer victims are yielding to attackers' ransom demands, it added. The development comes amid increased fragmentation of the ransomware ecosystem and threat actors shifting towards more stealthy methods, such as defense evasion and persistence techniques, to prioritize data theft and prolonged, low-noise access. Mobile Blockchain Wallet Found Vulnerable to Severe Flaws — An unnamed mobile blockchain wallet app for Android has been found susceptible to two independent severe vulnerabilities, allowing untrusted deep links to trigger sensitive wallet flows and trick users into approving phishing-driven transactions, as well as retain cryptographic private keys from the device despite deleting an account. This meant that an attacker with later device access could re-import the account using its public address and regain full signing authority without re-entering the keys. According to LucidBit Labs, the vulnerabilities have been patched by the developer. "The main strength of crypto wallets lies in their cryptographic foundations," security researcher Assaf Morag said. "However, when these wallets are implemented as user-facing applications, the overall orchestration of the system becomes just as critical as the cryptography itself. As the saying goes, a system’s security posture is defined by its weakest link. In this case, the two vulnerabilities demonstrate how flaws at the application layer can undermine the entire security model, despite the strength of the underlying cryptography." Kubernetes RCE Via Nodes/Proxy GET Permission — New research has identified an authorization bypass in Kubernetes Role-based access control (RBAC) that allows a service account with nodes/proxy GET permissions to execute commands in any Pod in the cluster. The issue exploits a bug in how Kubernetes API servers handle WebSocket connections. "Nodes/proxy GET allows command execution when using a connection protocol such as WebSockets," security researcher Graham Helton said. "This is due to the Kubelet making authorization decisions based on the initial WebSocket handshake's request without verifying CREATE permissions are present for the Kubelet's /exec endpoint, requiring different permissions depending solely on the connection protocol. The result is anyone with access to a service account assigned nodes/proxy GET that can reach a Node's Kubelet on port 10250 can send information to the /exec endpoint, executing commands in any Pod, including privileged system Pods, potentially leading to a full cluster compromise." The Kubernetes project has declined to address the issue, stating its intended behavior. However, it's expected to release Fine-Grained Kubelet API Authorization (KEP-2862) next month to address the attack. "A targeted patch would require coordinated changes across multiple components with special-case logic," Edera said. "This is the kind of complexity that could lead to future vulnerabilities. Once KEP-2862 reaches GA and sees adoption, nodes/proxy can be deprecated for monitoring use cases." Other Key Stories on the Radar — The Israeli government is working on the country's first cybersecurity law, the U.S. National Security Agency (NSA) published Zero Trust Implementation Guidelines (ZIGs) to help organizations safeguard sensitive data, systems, and services against sophisticated cyber threats, Google Project Zero found multiple vulnerabilities that could be used to bypass a new Windows 11 feature called Administrator Protection and obtain admin privileges, threat actors are continuing to abuse Microsoft Teams functionality by leveraging guest invitations and phishing-themed team names to impersonate billing and subscription notifications, and a loader named PhantomVAI has been used in the wild over the past year to deploy other payloads, such as Remcos RAT, XWorm, AsyncRAT, DarkCloud, and SmokeLoader. 🔧 Cybersecurity Tools DetectFlow → It is an open-source detection pipeline from SOC Prime that matches streaming log events against Sigma rules in real time — before they ever reach your SIEM. Instead of relying on your SIEM to do the heavy lifting, it tags and enriches events in-flight using Apache Kafka and Flink, then passes the results downstream to wherever you need them. Built on 11 years of detection intelligence, it's designed for teams who want faster detection, more rule coverage, and less dependency on SIEM-imposed limits. ADTrapper → It is an open-source platform that analyzes Windows Active Directory authentication logs and flags threats using 54+ built-in detection rules — covering everything from brute force to AD CS attacks. It runs in Docker, deploys with one command, and supports SharpHound data for deeper AD analysis. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion That's your week. A lot happened. Some of it was bad, some of it was worse, and a little bit of it was actually good. The scoreboard is messy, like it always is. Same time next week — and if history is any guide, we'll have plenty more to talk about. Stay patched, stay skeptical, and maybe don't click that link.

A threat actor has been abusing the internet infrastructure top-level domain (TLD) .arpa to host phishing content on domains that should not resolve to IP addresses, Infoblox reports. The .arpa TLD is designed to map IP addresses to domains, providing reverse DNS records, and should not host web content, as other TLDs do. As part of the newly uncovered campaign, however, a threat actor has been abusing DNS record management controls of certain providers to add IP address records for .arpa domains and serve phishing content to victims. Impersonating major brands, the phishing emails display an image hiding an embedded hyperlink designed to take the victim to the malicious website after a series of redirects. The links use a reverse DNS string instead of a standard domain name, but the actual domain is hidden from the victim’s view to avoid raising suspicion. As part of the .arpa phishing campaign, the threat actor has exploited a vulnerability at DNS providers that allowed them to claim ownership of .arpa domains. “To make this attack work, the threat actor acquires some IPv6 address space, for which they are delegated control of the corresponding .arpa subdomain. Then, instead of adding the expected PTR records, they create A records for the reverse DNS names,” Infoblox explains. These records were created through Cloudflare and Hurricane Electric, but other DNS providers also allow the configuration. While .arpa domains are typically trusted and the domain names unlikely to be blocked, the threat actor further made the reverse DNS domains difficult to identify and block by prepending them with randomly generated subdomains, creating unique Fully Qualified Domain Names (FQDNs) that were then used to build phishing email HTMLs. The identified reverse DNS FQDNs resolved to two IP addresses belonging to Cloudflare’s edge network, essentially hiding the location of the malicious content. Infoblox also discovered that the threat actor hijacked the Canonical Name (CNAME) records of known education, government, media, retail, and telecommunication entities and abused subdomains of their legitimate domains in their phishing attacks. “We also saw a few cases of domain shadowing, in which an actor-controlled subdomain is created, typically through credential theft. The lure images are unrelated to the hijacked domains. As with the IPv6 reverse domains, victims are unlikely to ever notice them,” Infoblox notes. The company observed hijacked CNAMEs being constantly abused in phishing attacks since September 2025, some in more than 100 different email runs per day. Some of the domains have been abused for years, and the toolkit used in this campaign has been used by multiple threat actors since 2017. Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: LastPass Warns of New Phishing Campaign Related: ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing

Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: BlacksmithAI: Open-source AI-powered penetration testing framework BlacksmithAI is an open-source penetration testing framework that uses multiple AI agents to execute different stages of a security assessment lifecycle. BlacksmithAI runs as a hierarchical system in which an orchestrator coordinates task execution across specialized agents. Security debt is becoming a governance issue for CISOs Application security backlogs keep expanding across large development portfolios. Veracode’s 2026 State of Software Security Report puts numbers behind a familiar operational pattern, fixes lag discovery, and older weaknesses stay open across release cycles. Your dependencies are 278 days out of date and your pipelines aren’t protected Applications continue to ship with known weaknesses even as development workflows speed up. A new Datadog State of DevSecOps 2026 report examines how dependency management and pipeline practices are influencing exposure across cloud native environments. AI went from assistant to autonomous actor and security never caught up Enterprise AI deployments have shifted from pilot programs to production systems handling customer data, executing business transactions, and integrating with core infrastructure. That has exposed a significant gap between what AI agents can do and what security teams can observe or control. Cybersecurity is now the price of admission for industrial AI Industrial organizations are accelerating AI deployment across manufacturing, utilities, and transportation and running straight into a security problem. Cisco’s 2026 State of Industrial AI Report, based on responses from more than 1,000 decision-makers across 19 countries, finds that cybersecurity has become the single largest obstacle to AI adoption, outranking skills gaps, integration challenges, and budget constraints. Cybersecurity professionals are burning out on extra hours every week Cybersecurity professionals in the U.S. are working an average of 10.8 extra hours per week beyond their contracted schedules, according to survey data collected from 300 cybersecurity and IT leaders by Sapio Research. That figure effectively adds a sixth working day to the standard week for a large portion of the field. Nearly half of respondents reported working 11 or more overtime hours weekly, and one in five logged more than 16 additional hours. The vulnerability that turns your AI agent against you Zenity Labs disclosed PleaseFix, a family of critical vulnerabilities affecting agentic browsers, including Perplexity Comet, that allow attackers to hijack AI agents, access local files, and steal credentials within authenticated user sessions. The vulnerabilities can be triggered through malicious content embedded in routine workflows, enabling unauthorized actions without user awareness. Threat actors weaponize OAuth redirection logic to deliver malware An ongoing phishing campaign is abusing the OAuth authentication redirection mechanism to avoid triggering conventional email and browser defenses, Microsoft researchers have revealed. The attackers are targeting government and public-sector organizations, and redirecting unsuspecting users from trusted login pages to their own infrastructure, to serve malware or capture login credentials. Coruna: Spy-grade iOS exploit kit powering financial crime A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s Threat Intelligence Group (GTIG). Over 1,200 IceWarp servers still vulnerable to unauthenticated RCE flaw (CVE-2025-14500) A critical RCE vulnerability (CVE-2025-14500) in IceWarp, an EU-made business communication and collaboration platform, may be exploited by attackers to gain unauthorized access to exposed unpatched servers. According to the Shadowserver Foundation, there are currently over 1,200 internet-facing instances that have yet to receive a fix, and the organization is sending out alerts to the owners, urging them to update. As AI agents start making purchases, security teams must rethink risk In this Help Net Security interview, Donald Kossmann, CTO at fintech company Chargebacks911, talks about the emerging security, fraud, and governance risks of “agentic commerce,” where AI agents can autonomously make purchasing decisions on behalf of users or organizations. FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) A newly discovered vulnerability (CVE-2026-28289) in the open-source help desk platform FreeScout could allow attackers to take over vulnerable servers by sending a specially crafted email to a FreeScout mailbox. FreeScout is a free, open-source help desk and shared inbox system used by businesses or teams to manage customer support conversations in one place. Cisco warns of SD-WAN Manager exploitation, fixes 48 firewall vulnerabilities Cisco has confirmed that two Catalyst SD-WAN Manager vulnerabilities (CVE-2026-20128 and CVE-2026-20122) patched in late February 2025 are being exploited by attackers. CVE-2026-20128 is a bug in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager, which could allow an authenticated, local attacker to gain DCA user privileges on an affected system. Iran-linked APT targets US critical sectors with new backdoors An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader cyber operations connected to escalating geopolitical tensions in the Middle East. Why workforce identity is still a vulnerability, and what to do about it Most organizations believe they have workforce identity under control. New hires are verified. Accounts are provisioned. Multi-factor authentication is enforced. Audits are passed. Then a breach happens, often through an account that was “properly secured.” But the problem can be traced back to the fact that identity verification, provisioning, authentication, and recovery operate as separate events, not a continuous system of trust. Engineering trust: A security blueprint for autonomous AI agents AI agents have evolved from just chatbots, answering questions to executing actions using various integrated tools, often autonomously, and as such the traditional security models have become less efficient. A single malicious instruction hidden in a webpage (that the agent processes), can manipulate that agent into performing unintended actions or leaking sensitive data. March 2026 Patch Tuesday forecast: Is AI security an oxymoron? Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products directly. But just how secure are these AI tools and routines themselves? Recent reports show they suffer from vulnerabilities just like any other code. When cyber threats start thinking for themselves In this Help Net Security video, Jason Rivera, Field CISO & Head of Solution Engineering at SimSpace, discusses how autonomous AI agents are changing cyber threats. Drawing on experience in the US Army, NSA, Deloitte, and CrowdStrike, he describes how security teams have traditionally measured risk through volume, speed, and sophistication. Why phishing still works today In this Help Net Security video, Gal Livschitz, Senior Penetration Tester at Terra Security, explains how phishing has evolved and why employees still fall for it. He outlines how phishing now uses HTTPS, branded pages, and lookalike domains, making attacks harder to spot. He highlights communication overload as a key weakness that attackers exploit. Motorola turns to GrapheneOS for smartphone security upgrade Motorola is strengthening smartphone security through a long-term partnership with the GrapheneOS Foundation, a mobile security nonprofit that develops a hardened operating system based on the Android Open Source Project. Anthropic’s Claude hit by widespread service outage (updated) Anthropic suffered widespread service disruptions Monday morning, leaving thousands of users unable to access its Claude AI platform. Most users reporting problems said they encountered errors when attempting to log in. Meta AI in WhatsApp organizes chats and reopens privacy issues The trend of integrating AI into digital platforms continues. In the latest Android beta release (2.26.9.4), the company has introduced a feature that allows users to organize their chat history with the help of Meta AI. Anthropic poaches users from rival chatbots with easier migration The controversy over Anthropic’s negotiations with the Pentagon has driven increased interest in Claude. Negotiations between the Department of Defense and Anthropic collapsed after a deadline for an agreement expired without a deal. The Pentagon had pressed the company to loosen certain restrictions on how its AI systems could be used. Anthropic declined and kept its existing policy limits in place. $100 radio equipment can track cars through their tire sensors When people consider what might track their movements, they think of smartphone apps, GPS services, or roadside cameras. The tires of a new car rarely enter that equation. Researchers at IMDEA Networks Institute, together with European partners, found that Tire Pressure Monitoring System (TPMS) sensors inside each wheel broadcast unencrypted wireless signals containing persistent identifiers. Google speeds up Chrome updates with new security-focused release cycle The Chrome browser is moving to a two-week release cycle, a change intended to give developers and users faster access to new features, performance improvements and bug fixes. The new schedule begins with the stable release of Chrome 153 on September 8, 2026, followed by new beta and stable releases every two weeks. The change applies to desktop, Android and iOS platforms, while the Dev and Canary channels remain unchanged. Workers reviewing Meta Ray-Ban footage encounter users’ intimate moments Bank details and intimate moments captured without people realizing they are being recorded are the new privacy nightmare behind the latest tech fashion hit, Meta Ray-Ban smart glasses. A joint investigation by Svenska Dagbladet and Göteborgs-Posten found that footage and audio recorded by Meta’s Ray-Ban smart glasses are reviewed by human contractors in Kenya, including recordings containing sensitive personal material. Authorities pull plug on Tycoon 2FA phishing-as-a-service platform Tycoon 2FA, a phishing-as-a-service platform that allowed cybercriminals to bypass MFA and break into online accounts, has been disrupted by law enforcement agencies and cybersecurity partners. Western governments lay the groundwork for secure 6G networks Governments are preparing for 6G, the next generation of mobile networks, placing security and resilience among their top priorities. In response, seven countries participating in the Global Coalition on Telecoms (GCOT) have introduced a set of 6G Security and Resilience Principles, developed with support from industry partners. Backup strategies are working, and ransomware gangs are responding with data theft Business email compromise (BEC) and funds transfer fraud combined for 58% of all cyber insurance claims filed in 2025, according to data from Coalition covering more than 100,000 policyholders across the United States, Canada, the United Kingdom, Australia, and Germany. OpenAI’s GPT-5.4 doubles down on safety as competition heats up In the midst of recent developments and controversies surrounding a contract with the U.S. Department of Defense, OpenAI released the GPT-5.4 model. The release comes at a time when users are reportedly leaving ChatGPT for rival chatbots, particularly Anthropic’s Claude. Microsoft working on Teams feature to keep unauthorized bots at bay Microsoft plans to add a new Teams feature that lets meeting admins identify and control third-party bots before they join. According to the Microsoft 365 Roadmap, the feature is scheduled to begin rolling out in May 2026 on Desktop, Mac, Linux, iOS, and Android versions of Microsoft Teams. AI risk moves into the security budget spotlight Enterprises are pushing AI deeper into workflows that touch sensitive data across cloud platforms and SaaS apps. The 2026 Thales Data Threat Report, based on a survey of 3,120 respondents in 20 countries, places that shift alongside growing pressure on data protection, identity controls, and cloud security. UK reduces cyberattack fix times from two months to eight days The UK government has launched a new vulnerability monitoring service (VMS) that promises to reduce the time needed to fix critical cyber weaknesses across the public sector. The service, launched as part of the Blueprint for Modern Digital Government, published in January 2025, continuously scans internet-facing systems at around 6,000 public sector organizations. Using commercial and proprietary tools, it detects about 1,000 types of cyber vulnerabilities. IPFire ships its 200th core update with a new domain blocklist and kernel upgrade Network firewall distribution IPFire released Core Update 200, marking the 200th incremental update to the 2.29 branch. The release bundles a kernel upgrade, a beta domain blocklist service, security patches for OpenSSL and glibc, and a range of component updates. 5 years of shifting cybersecurity behavior Online security is built through routine decisions made across devices and accounts. People choose how to create passwords, how often to reuse them, and how much effort to invest in protecting personal data. The National Cybersecurity Alliance and CybSafe’s Oh, Behave! The Cybersecurity Attitudes and Behaviors Report: 2021–2025 follows those patterns over five years, drawing on responses from more than 24,000 adults and documenting how attitudes and behaviors shift over time. Healthcare organizations are accepting cyber risk to cut costs Healthcare organizations are cutting cybersecurity budgets under financial pressure even as the threats targeting their systems intensify. A PwC survey of 381 global healthcare executives, conducted between May and July 2025, puts numbers to the gap between the risks the sector faces and the controls it has in place. Android’s March 2026 security patch fixes over 100 flaws, one under targeted exploitation The Android March 2026 security patch addresses vulnerabilities across dozens of components and includes one CVE confirmed under active exploitation. Devices running a patch level of 2026-03-05 or later receive fixes for all disclosed issues. New Defender deployment tool streamlines Windows device onboarding with single executable Microsoft’s Defender deployment tool for Windows helps administrators manage device onboarding at scale with updated progress visibility and additional controls. Cloudflare tracked 230 billion daily threats and here is what it found Cloudflare’s network blocks over 230 billion threats per day. The volume indicates how routine and automated the attack cycle has become, and the patterns behind that volume point to a shift in how breaches begin and progress. Cloudflare’s threat research unit, Cloudforce One, published its inaugural cyber threat report 2026, covering activity observed through 2025 and projecting into the year ahead. The report draws on telemetry from Cloudflare’s network, which handles roughly 20% of global web traffic. Immutable Linux distribution Nitrux 6.0.0 adds GPU passthrough, boot-level recovery, C++ update system Nitrux 6.0.0, released March 3, 2026, packages several components that security practitioners running Linux workstations will find worth examining: a new hypervisor orchestrator with IOMMU-enforced isolation, a rewritten update system with cryptographic verification, and a recovery mechanism that operates from within the boot process itself. LeakBase cybercrime forum with 142,000 users taken down in global operation LeakBase, an open-web cybercrime forum facilitating the trade of leaked databases and “stealer logs” containing stolen credentials, has been taken down in an international law enforcement operation coordinated by Europol and involving authorities from 14 countries. Google changes Play Store policies after settling Epic Games dispute Google is making changes to the Play Store after settling its legal fight with Epic Games, focusing on three areas: more billing options, lower fees with new programs for developers, and a program for registered app stores. That attractive online ad might be a malware trap Malware increasingly travels through the infrastructure that delivers online advertising. The Media Trust’s Global Report on Digital Trust, Ad Integrity, and the Protection of People describes a digital ad ecosystem where scam campaigns, malicious redirects, and malware delivery appear alongside marketing traffic. What happens when AI teams compete against human hackers A cybersecurity competition produced what may be the largest controlled dataset comparing AI-augmented teams to human-only teams on professional-grade offensive security tasks. The event, called NeuroGrid, ran for 72 hours on the Hack The Box platform and drew 1,337 registered human-only teams and 156 registered AI-agent teams competing across 36 challenges in nine security domains at four difficulty levels. Cursor Automations turns code review and ops into background tasks Cursor Automations, the always-on agent platform from Cursor, is expanding with a new generation of autonomous systems that streamline code review, incident response, and other engineering workflows. The platform runs AI agents on schedules or in response to development events. New cyber module strengthens risk planning for health organizations The Administration for Strategic Preparedness and Response’s (ASPR) new cybersecurity module in the Risk Identification and Site Criticality (RISC) 2.0 Toolkit helps organizations identify critical gaps, prioritize investments, and make informed decisions about risk mitigation to reduce disruptions to patient care and strengthen resilience. Secure by Design: Building security in at the beginning Secure by Design is not a single tool, product, or one‑time activity. It is a holistic approach that requires security to be deliberately embedded from the very beginning, at the point where systems, software, and services are conceived and designed. Rather than reacting to vulnerabilities after deployment, Secure by Design emphasizes anticipating risk early and addressing it through intentional design decisions, clearly defined security requirements, and accountability across the entire lifecycle. Webinar: The True State of Security 2026 In the webinar The True State of Security 2026, you’ll gain insight into why AI is distracting teams from more persistent risks and how human access and permissions remain the weakest link. You’ll also learn why current security workflows are slowing organizational growth and what a balanced security strategy should look like heading into 2026. Cybersecurity jobs available right now: March 3, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: March 6, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Beazley Security, Push Security, Samsung, and Tufin.

The phishing-as-a-service platform was popular among cyber threat actors because of its ability to bypass multifactor authentication defenses.

L’infrastruttura di Tycoon 2FA, una delle piattaforme di phishing-as-a-service (PhaaS) più diffuse tra i criminali informatici e la minaccia adversary-in-the-middle (AiTM) con il più elevato volume di attività rilevata, è stata smantellata, grazie alla collaborazione tra partner pubblici e privati, tra cui spiccano Proofpoint, Microsoft, Europol. “L’azione di oggi si concentra su un importante attore del crimine informatico, Tycoon 2FA, responsabile del più alto volume di campagne di credential phishing AiTM secondo i dati Proofpoint”, commenta Selena Larson, Staff Threat Researcher di Proofpoint. Indice degli argomenti La collaborazione tra partner pubblici e privati ha visto cooperare Proofpoint, Microsoft, Europol, Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel 471, Resecurity, The Shadowserver Foundation, SpyCloud e TrendAI, oltre ad altre forze dell’ordine europee, per neutralizzare Tycoon 2FA. In particolare, Proofpoint ha offeryo un importante contributo nelle indagini delle forze dell’ordine e del settore privato sull’attività di Tycoon 2FA, sostenendo l’azione di Microsoft con dati che comprendono domini malevoli e informazioni sulle campagne Tycoon 2FA. “Gli attacchi Tycoon hanno portato alla compromissione di decine di migliaia di account, e Proofpoint ha osservato come questi attacchi prendano di mira organizzazioni critiche in settori quali sanità, istruzione, pubblica amministrazione e difesa“, sottolinea Selena Larson. L’azione di disruption contro Tycoon 2FA – e la causa legale che identifica il suo creatore – avranno un impatto significativo sulla piattaforma stessa, sulla relativa infrastruttura e sull’attività dei threat actor. Tycoon 2FA opera come un kit di phishing AiTM. La sua funzione principale è sottrarre username, password e cookie di sessione di Microsoft 365 e Gmail. Gli aggressori utilizzano questi cookie per aggirare i controlli di autenticazione a più fattori (MFA) nelle sessioni successive, ottenendo così il takeover completo dell’account (ATO) e accesso non autorizzato agli account, ai sistemi e ai servizi cloud dell’utente, inclusi quelli protetti dall’MFA come misura di sicurezza ulteriore. “Secondo dati di Proofpoint, nel 2025 il 99% delle organizzazioni ha subito tentativi di account takeover, riusciti nel 67% dei casi. Tra questi, il 59% degli account compromessi aveva l’MFA attivo”, mette in guardia Selena Larson: “Sebbene non tutti questi attacchi siano riconducibili a Tycoon 2FA, i dati dimostrano l’impatto del phishing AiTM sulle aziende”. Sebbene non tutte le campagne ATO che bypassano l’MFA siano attribuibili a Tycoon 2FA, quest’ultima resta la minaccia phishing AiTM con il più alto volume rilevato da Proofpoint. I volumi variano in base all’attività dei criminali informatici: nel solo febbraio 2026, Proofpoint ha scoperto oltre tre milioni di messaggi riconducibili a Tycoon 2FA. “Questi attacchi informatici, che consentono il takeover completo degli account, possono avere conseguenze devastanti, tra cui attacchi ransomware o la perdita di dati sensibili. Mentre i criminali informatici continuano a prendere di mira le identità digitali, l’accesso agli account email aziendali rappresenta spesso il primo passo di una catena di attacchi dalle conseguenze distruttive. (…) Smantellare l’infrastruttura associata a Tycoon 2FA e identificare il presunto responsabile della creazione di questo prolifico strumento di hacking avrà un impatto significativo sul credential phishing che bypassa l’MFA e, si spera, infliggerà un duro colpo alphishing-as-a-service AiTM più prolifico al mondo”, conclude Selena Larson. In coordinamento con Europol, le forze dell’ordine di Lettonia, Lituania, Portogallo, Polonia, Spagna e Regno Unito hanno sequestrato l’infrastruttura ed altre misure operative. Microsoft e il co-ricorrente Health-ISAC hanno inoltre depositato una causa legale contro il presunto creatore di Tycoon 2FA, Saad Fridi, e alcuni associati non identificati. L’azione di disruption e il procedimento civile, depositato presso il Southern District of New York, avranno un effetto rilevante sulle operazioni di Tycoon 2FA e sull’attività complessiva della minaccia. Proofpoint ha offerto supporo all’azione di Microsoft fornendo dati sulle minacce tratti dalla propria visibilità, inclusi domini malevoli e informazioni sulle campagne Tycoon 2FA, e ha depositato una dichiarazione a supporto della causa. Il 4 marzo 2026, Microsoft ha annunciato la causa legale e l’azione di disruption contro il creatore di Tycoon 2FA e diversi associati non identificati. Proofpoint sostiene il procedimento civile fornendo una dichiarazione sull’attività di Tycoon, con dettagli sull’infrastruttura e sulle campagne. Microsoft ha posto sotto sequestro 330 domini del pannello di controllo associati a Tycoon 2FA. Azione che avrà un impatto sulle operazioni, interrompendo l’attività criminale in corso. I takeover di account di successo possono causare danni ingenti alle organizzazioni colpite, tra cui perdite finanziarie e reputazionali, sottrazione di dati proprietari e potenziali attacchi successivi come il ransomware, con conseguenze distruttive per l’intera organizzazione.

A 43-year-old Russian national has pleaded guilty in a US court to charges stemming from his role in the Phobos ransomware operation. The man, Evgenii Ptitsyn, was arrested in South Korea in June 2024 and extradited to the United States in November of the same year. The US Justice Department announced on Wednesday that Ptitsyn has now pleaded guilty to wire fraud conspiracy, for which he faces up to 20 years in prison. Sentencing is scheduled for July 15. According to authorities, Ptitsyn was involved in the Phobos scheme since at least November 2020, helping with the sale, distribution, and operation of the ransomware. Ptitsyn appears to have been part of the administration team, which offered malware and infrastructure that affiliates could use to target victims and obtain ransom payments. The Phobos operation emerged in 2019 and targeted more than 1,000 organizations worldwide, with cybercriminals believed to have obtained over $16 million in ransom payments. Authorities in the United States and Europe have taken significant action against the Phobos operation in recent years, announcing infrastructure takedowns and arrests. The most recent arrest was announced last month. Police in Poland apprehended a 47-year-old man who appears to be suspected of being a Phobos affiliate. Related: LeakBase Cybercrime Forum Shut Down, Suspects Arrested Related: Tycoon 2FA Phishing Platform Dismantled in Global Takedown Related: Ukrainian Nefilim Ransomware Affiliate Extradited to US Related: US Charges 31 More Defendants in Massive ATM Hacking Probe

Police dismantle major phishing platform blamed for attacks on hospitals and schools International law enforcement agencies have dismantled a major phishing-as-a-service platform used to target hundreds of thousands of accounts worldwide, including those tied to hospitals and schools, Europol said Wednesday. The service, known as Tycoon 2FA, offered criminals a ready-made toolkit for stealing login credentials and bypassing multi-factor authentication, allowing attackers to access accounts even when additional security checks were enabled. Authorities disrupted the operation by seizing 330 domains used to host phishing sites and operate the platform’s infrastructure. Active since 2023, Tycoon 2FA sent tens of millions of phishing emails each month and targeted more than 500,000 organizations worldwide. Healthcare and education organizations were among the hardest hit. Microsoft said more than 100 members of Health-ISAC, a cybersecurity information-sharing group for the health sector, were successfully phished. In New York alone, at least two hospitals, six public schools and three universities reported attempted or successful compromises tied to Tycoon 2FA. “These incidents had tangible consequences,” Microsoft stated, with compromised accounts leading to operational disruptions and delays in patient care. Unlike conventional phishing kits that simply harvest passwords, Tycoon 2FA was designed to defeat strong security protections. The service intercepted authentication sessions in real time, capturing both login credentials and one-time verification codes. This allowed attackers to log in as legitimate users without triggering security alerts. The platform also lowered the barrier to cybercrime by packaging sophisticated phishing tools into a subscription-based service. At its peak, Tycoon 2FA accounted for about 62% of all phishing attempts blocked by Microsoft. “Taking this infrastructure offline cuts off a major pipeline for account takeovers and helps protect people and organizations from follow-on attacks such as data theft, ransomware, business email compromise and financial fraud,” the company said. Authorities believe the service’s developer is based in Pakistan and worked with partners responsible for marketing, payments and customer support. Cybercriminals often paired Tycoon 2FA alongside other illicit services that handled mass email distribution, malware hosting and the resale of stolen account access to conduct high-scale cybercrime campaigns. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Authorities pull plug on Tycoon 2FA phishing-as-a-service platform Tycoon 2FA, a phishing-as-a-service platform that allowed cybercriminals to bypass MFA and break into online accounts, has been disrupted by law enforcement agencies and cybersecurity partners. Takedown of the Tycoon 2FA phishing-as-a-service platform (Source: Europol) Active since August 2023, Tycoon 2FA was among the largest phishing operations worldwide. At its peak, the platform accounted for about 62% of phishing attempts blocked by Microsoft, according to investigators. The service operated on a subscription model and gave cybercriminals tools to intercept live authentication sessions and access online accounts, including those protected by additional security layers. During the operation, investigators took down 330 domains used by the platform for phishing pages and control panels. “At scale, the platform generated tens of millions of phishing emails each month and facilitated unauthorised access to nearly 100,000 organizations globally, including schools, hospitals and public institutions,” Europol stated. Microsoft led the technical disruption of the service with support from private sector partners, while law enforcement in Latvia, Lithuania, Portugal, Poland, Spain and the UK seized infrastructure in an operation coordinated by Europol.

Tycoon 2FA, one of the prominent phishing-as-a-service (PhaaS) toolkits that allowed cybercriminals to stage adversary-in-the-middle (AitM) credential harvesting attacks at scale, was dismantled by a coalition of law enforcement agencies and security companies. The subscription-based phishing kit, which first emerged in August 2023, was described by Europol as one of the largest phishing operations worldwide. The kit was sold via Telegram and Signal for a starting price of $120 for 10 days or $350 for access to a web-based administration panel for a month. Tycoon 2FA's primary developer is alleged to be Saad Fridi, who is said to be based in Pakistan. The panel serves as a hub for configuring, tracking, and refining campaigns. It features pre‑built templates, attachment files for common lure formats, domain and hosting configuration, redirect logic, and victim tracking. Operators can also configure how the malicious content is delivered through attachments, as well as keep tabs on valid and invalid sign-in attempts. The captured information, such as credentials, multi-factor authentication (MFA) codes, and session cookies, can be downloaded directly within the panel or forwarded to Telegram for near‑real‑time monitoring. "It enabled thousands of cybercriminals to covertly access email and cloud-based service accounts," Europol said. "At scale, the platform generated tens of millions of phishing emails each month and facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions." As part of the coordinated effort, 330 domains that formed the backbone of the criminal service, including phishing pages and control panels, have been taken down. Characterizing Tycoon 2FA as "dangerous," Intel 471 said the kit was linked to over 64,000 phishing incidents and tens of thousands of domains, generating tens of millions of phishing emails each month. According to Microsoft, which is tracking the operators of the service under the name Storm-1747, Tycoon 2FA became the most prolific platform observed by the company in 2025, prompting it to block more than 13 million malicious emails linked to the crimeware service in October 2025. In total, Tycoon 2FA accounted for approximately 62% of all phishing attempts blocked by Microsoft as of mid-2025, including more than 30 million emails in a single month. The service has been linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers, the tech giant added. Geographic analysis of victim log data by SpyCloud indicates that the U.S. had the largest concentration of identified victims (179,264), followed by the U.K. (16,901), Canada (15,272), India (7,832), and France (6,823). "The overwhelming majority of targeted accounts were enterprise-managed or otherwise associated with paid domains, reinforcing the conclusion that Tycoon 2FA is primarily directed at business environments rather than individual consumer accounts," the cybersecurity company said. Data from Proofpoint shows that Tycoon 2FA accounted for the highest volume AiTM phishing threats. The email security company said it observed over three million messages associated with the phishing kit in February 2026 alone. Trend Micro, which was one of the private sector partners in the operation, noted that the PhaaS platform had approximately 2,000 users. Campaigns leveraging Tycoon 2FA have indiscriminately targeted almost all sectors, including education, healthcare, finance, non-profit, and government. Phishing emails sent from the kit reached over 500,000 organizations each month worldwide. "Tycoon 2FA's platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail," Microsoft said. "It also allowed threat actors using its service to establish persistence and to access sensitive information even after passwords are reset, unless active sessions and tokens were explicitly revoked. This worked by intercepting session cookies generated during the authentication process, simultaneously capturing user credentials. The MFA codes were subsequently relayed through Tycoon 2FA's proxy servers to the authenticating service." The kit also employed techniques like keystroke monitoring, anti-bot screening, browser fingerprinting, heavy code obfuscation, self-hosted CAPTCHAs, custom JavaScript, and dynamic decoy pages to sidestep detection efforts. Another key aspect is the use of a broader mix of top-level domains (TLDs) and short-lived fully qualified domain names (FQDNs) to host the phishing infrastructure on Cloudflare. The FQDNs often only last for 24 to 72 hours, with the rapid turnover a deliberate effort to complicate detection and prevent building reliable blocklists. Microsoft also attributed Tycoon 2FA's success to closely mimicking legitimate authentication processes to stealthily intercept user credentials and session tokens. To make matters worse, Tycoon 2FA customers leveraged a technique called ATO Jumping, whereby a compromised email account is used to distribute Tycoon 2FA URLs and attempt further account takeover activities. "Using this technique enables emails to look like they are authentically coming from a victim’s trusted contact, increasing the likelihood of a successful compromise," Proofpoint noted. Phishing kits like Tycoon are designed to be flexible so that it's accessible to less technically savvy actors while still offering advanced capabilities for more experienced operators. "In 2025, 99% of organizations experienced account takeover attempts in 2025, and 67% experienced a successful account takeover," Selena Larson, staff threat researcher at Proofpoint, said in a statement shared with The Hacker News. "Of these, 59% of the taken-over accounts had MFA enabled. While not all of these attacks were related to Tycoon MFA, this shows the impact of AiTM phishing on enterprises." "These cyberattacks that enable full account takeovers can lead to disastrous impacts, including ransomware or the loss of sensitive data. As threat actors continue to prioritize identity, gaining access to enterprise email accounts is often the first step in an attack chain that can have destructive consequences."

Europol, Microsoft, and cybersecurity companies on Wednesday announced a joint effort to take down the widely used phishing-as-a-service platform Tycoon 2FA. Tycoon 2FA is a subscription-based platform that enables threat actors to impersonate users, create phishing pages, and bypass multi-factor authentication (MFA). It has allowed malicious hackers to intercept authentication sessions and gain access to targeted email and cloud accounts without triggering alerts. “Tycoon 2FA combined convincing phishing templates, realistic landing pages, and real‑time capture of credentials and authentication codes into an easy‑to‑use package that scaled quickly. By lowering the technical barrier to entry, it allowed criminals with limited expertise to run sophisticated impersonation campaigns,” Microsoft said. According to the tech giant, Tycoon 2FA accounted for roughly 62% of the phishing attempts it blocked last year. The platform had been used to send out tens of millions of phishing emails to 500,000 organizations every month. “Despite extensive defenses, the service is linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers,” Microsoft said. The disruption of the cybercrime platform involved court orders, intelligence from major cybersecurity firms, and the seizure of 330 active Tycoon 2FA domains, including control panels and phishing pages. Law enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said. The list of security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm Crowell, and cybersecurity organizations Shadowserver and Health-ISAC. In addition to the takedown of the Tycoon 2FA infrastructure, legal action has been taken against multiple individuals suspected of running the operation, including Saad Fridi, based in Pakistan and believed to be the platform’s main developer. Related: RaccoonO365 Phishing Service Disrupted, Leader Identified Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: 1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform linked to tens of millions of phishing messages each month. In total, 330 domains part of the criminal service's backbone infrastructure (including control panels and phishing pages) were seized and taken offline during this joint action. "The technical disruption was led by Microsoft with the support of a coalition of private partners, while seizure of infrastructure and other operational measures were carried out by law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom – all of this coordinated by Europol," Europol said on Wednesday. "The investigation began after intelligence was shared by Trend Micro. Europol disseminated this information through its EC3 Advisory Groups and operational networks, enabling a coordinated operational strategy to be developed." The action was also supported by Cloudflare, Coinbase, Intel471, Proofpoint, Shadowserver Foundation, SpyCloud, eSentire, Crowell, Resecurity, and Health-ISAC. Tycoon2FA (also known as Tycoon 2FA and operated by a threat group tracked as Storm-1747) has been active since at least August 2023 and was used by cybercriminals to bypass multi-factor authentication (MFA) protections and compromise accounts belonging to nearly 100,000 organizations worldwide, including government institutions, schools, and healthcare organizations. According to Microsoft, Tycoon2FA was generating tens of millions of phishing emails each month by mid-2025, reaching more than 500,000 organizations and accounting for 60% of all blocked phishing attempts. It operated as an adversary-in-the-middle platform, using a reverse proxy server to intercept victims' login credentials and session cookies in real time, in attacks targeting Microsoft and Google customers. However, it allowed attackers to hijack authenticated sessions and circumvent MFA protections, even though the login process appeared to succeed normally from the victims' perspective. "Tycoon2FA's platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail. It also allowed threat actors using its service to establish persistence and to access sensitive information even after passwords are reset, unless active sessions and tokens were explicitly revoked," Microsoft said today. "This worked by intercepting session cookies generated during the authentication process, simultaneously capturing user credentials. The MFA codes were subsequently relayed through Tycoon2FA's proxy servers to the authenticating service." Sold through Telegram for $120 for 10 days of access, Tycoon2FA lowered the barrier for low-skilled criminals to launch sophisticated, MFA-bypassing attacks at scale. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Investigators claimed today to have taken out another key player in the global cybercrime supply chain after seizing infrastructure linked to phishing-as-a-service (PhaaS) operation Tycoon 2FA. The effort was led by Microsoft and Europol and supported by a range of industry partners, including TrendAI, Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel471, Proofpoint, Resecurity, The Shadowserver Foundation, and SpyCloud. Over 300 domains linked to Tycoon2FA were seized in the operation, according to TrendAI. Tycoon2FA offered subscription-based PhaaS that used adversary-in-the-middle techniques to intercept live authentication sessions, and capture credentials, one-time passcodes and active session cookies in real time. This enabled threat actors using it to bypass multi-factor authentication (MFA) and access countless enterprise accounts in large-scale attacks on corporate inboxes. Tycoon2FA had around 2000 users and used more than 24,000 domains since its launch in August 2023. “This was not a single phishing campaign. It was an industrialized service built to make MFA bypass accessible to thousands of criminals,” said Robert McArdle, director for cybercrime research at TrendAI. “Identity is now the primary attack surface. When session hijacking can be packaged and sold as a subscription, the risk shifts from isolated incidents to systemic exposure.” More Work Still to Do TrendAI and other industry partners passed on crucial threat intelligence to law enforcement regarding Tycoon2FA infrastructure and campaigns. They assessed the primary operator to be a threat actor using the online identities “SaaadFridi” and “Mr_Xaad.” However, with the perpetrator and many more like him still at large, security experts urged network defenders to build resilience against PhaaS. TrendAI recommended that organizations: Adopt phishing-resistant authentication and enforce strict conditional access controls Deploy advanced email and collaboration security that can detect lateral phishing and brand impersonation Enable real-time URL inspection and web content analysis to identify fake login infrastructure Monitor identity risk posture continuously and take action quickly when anomalous session behavior is detected Conduct regular phishing simulations and security awareness training

Triage is supposed to make things simpler. In a lot of teams, it does the opposite. When you can’t reach a confident verdict early, alerts turn into repeat checks, back-and-forth, and “just escalate it” calls. That cost doesn’t stay inside the SOC; it shows up as missed SLAs, higher cost per case, and more room for real threats to slip through. So where does triage go wrong? Here are five triage issues that turn investigations into expensive guesswork, and how top teams are changing the outcome with execution evidence. 1. Decisions Made Without Real Evidence Business risk: The hardest triage failure to notice is when decisions get made before proof exists. If responders rely on partial signals (labels, hash matches, reputation), they end up approving or escalating cases without seeing what the file or link actually does. That uncertainty fuels false positives, missed real threats, slower containment, and higher cost per case, while giving attackers more time before anyone has confidence in the verdict. The Fix: Get Execution Evidence Early High-performing teams reduce this risk by validating behavior at triage, not later. Sandboxes make that practical by showing real execution: process activity, network calls, persistence, and the full attack chain. For example, with ANY.RUN’s interactive sandbox, teams report that in ~90% of cases, they can see the full attack chain within ~60 seconds, turning unclear alerts into evidence-backed decisions early in the workflow. In this real-world hybrid phishing scenario combining Tycoon 2FA and Salty 2FA, most traditional controls failed to detect the threat because the attack blended multiple kits and evasive redirects. Inside an interactive sandbox, however, the full malicious flow and a clear verdict appeared in just 35 seconds. Improve triage speed and certainty to cut MTTR by up to 21 minutes per case, control escalation costs, and limit real business exposure. Business outcomes: Faster, evidence-backed verdicts at triage Lower cost per case by reducing rework Fewer missed threats caused by “unclear” closures 2. Triage Quality Depends on Analyst Seniority Business risk: In many SOCs, the outcome of triage depends on who touches the alert. Senior staff close faster because they recognize patterns; junior staff escalates because they don’t have enough confidence or context. The result is inconsistent verdicts, uneven response speed, and a workflow that doesn’t scale cleanly as alert volume grows. The Fix: Make Triage Repeatable for Every Shift Top teams reduce this gap by designing triage around shared evidence and repeatable steps, not personal experience. The goal is simple: give Tier 1 enough clarity to reach the same conclusion a senior responder would, using the same observable facts. With ANY.RUN, teams can share the same sandbox session and findings through built-in teamwork features, so knowledge doesn’t stay in one person’s head. That consistency helps reduce “escalate to be safe” behavior and keeps triage outcomes stable across shifts. Business outcomes: Consistent triage across shifts Fewer senior reviews More predictable SLAs 3. Triage Delays Give Attackers More Time Business risk: Even when a threat is detected, triage can take too long to confirm what’s happening. Manual checks and queued escalations delay action, extending dwell time and giving attackers room to move laterally or exfiltrate data. The business impact shows up as missed SLAs and higher incident costs. The Fix: Shrink Time-to-Decision at Triage High-performing teams treat triage as a speed problem: reduce the steps between detection and a defensible verdict. That means confirming behavior immediately, before the case bounces between queues or turns into a long validation loop. With the interactive sandbox, suspicious files and URLs can be detonated quickly, and the full attack chain often becomes visible in under a minute. Operational results often show up to 21 minutes shaved off MTTR per case, because teams spend less time waiting, re-checking, and escalating just to confirm what’s happening. Business outcomes: Earlier confirmation, shorter dwell time Fewer SLA misses under load Smaller incident impact 4. Over-Escalation Hides Real Priority Incidents Business risk: When evidence is unclear, Tier 1 escalates “just to be safe,” and Tier 2 becomes a verification layer for borderline cases. That clogs queues, pulls senior time into “maybes,” and slows response to high-impact incidents, increasing cost per investigation and raising the risk that critical cases wait too long. The Fix: Close More Cases at Tier 1 with Execution Evidence When Tier 1 can prove or dismiss alerts independently, Tier 2 stays focused on real incidents instead of acting as a verification desk. With solutions like ANY.RUN, that becomes realistic because the sandbox is built for fast triage: it’s intuitive to use, provides AI-assisted guidance during analysis, and generates auto-built reports that capture the key evidence without extra manual write-ups. A dedicated IOCs tab also pulls indicators into one place, so Tier 1 can escalate with context rather than escalating for confirmation. This is how teams see up to a 30% reduction in Tier-1 → Tier-2 escalations, preserving senior capacity for high-risk threats. Business outcomes: Less Tier 2 overload Faster queues Lower escalation volume 5. Manual Work Limits Scale and Increases Error Business risk: A lot of triage is still repetitive manual work, following redirect chains, dealing with CAPTCHAs, or uncovering hidden links in QR codes. As volume grows, this limits throughput, increases mistakes, and triggers unnecessary escalation simply because teams run out of time. The Fix: Reduce Manual Steps with Interactive Automation Modern sandbox environments combine automation with human-like interactivity, allowing suspicious content to be safely opened, redirected flows followed, and protection mechanisms such as CAPTCHAs or QR-embedded links to be handled automatically during analysis. With ANY.RUN’s interactive sandbox, these routine triage actions are performed inside the controlled environment, exposing hidden malicious behavior while removing repetitive work from responders. In day-to-day operations, teams often see up to a 20% decrease in Tier 1 workload, along with fewer escalations and more time available for high-value investigation. Business outcomes: More Tier 1 capacity Fewer manual errors More time for confirmed threats Reduce Business Risk by Fixing Triage First Broken triage rarely looks dramatic. Instead, it quietly slows response, increases escalation pressure, and keeps real threats open longer than the business can afford. Teams that shift to evidence-driven, execution-based triage consistently report measurable gains, including: Up to 3× improvement in overall SOC efficiency 94% of users reported faster triage and clearer verdicts Up to 58% more threats identified across investigations Improving speed, certainty, and scalability at the triage stage is one of the fastest ways to reduce MTTR, control operational cost, and cut real business exposure. Explore evidence-driven triage for your SOC and turn faster decisions into measurable security performance.

Threat actors engaging in phishing attacks are exploiting routing scenarios and misconfigured spoof protections to impersonate organizations' domains and distribute emails that appear as if they have been sent internally. "Threat actors have leveraged this vector to deliver a wide variety of phishing messages related to various phishing-as-a-service (PhaaS) platforms such as Tycoon 2FA," the Microsoft Threat Intelligence team said in a Tuesday report. "These include messages with lures themed around voicemails, shared documents, communications from human resources (HR) departments, password resets or expirations, and others, leading to credential phishing." While the attack vector is not necessarily new, the tech giant said it has witnessed a surge in the use of the tactic since May 2025 as part of opportunistic campaigns targeting a wide variety of organizations across multiple industries and verticals. This includes a campaign that has employed spoofed emails to conduct financial scams against organizations. A successful attack could allow threat actors to siphon credentials and leverage them for follow-on activities, ranging from data theft to business email compromise (BEC). The problem manifests primarily in scenarios where a tenant has configured a complex routing scenario and spoof protections are not strictly enforced. An example of complex routing involves pointing the mail exchanger record (MX record) to either an on-premises Exchange environment or a third-party service before reaching Microsoft 365 This creates a security gap that attackers can exploit to send spoofed phishing messages that seem to originate from the tenant's own domain. The vast majority of phishing campaigns that leverage this approach have been found to make use of the Tycoon 2FA PhaaS kit. Microsoft said it blocked more than 13 million malicious emails linked to the kit in October 2025. PhaaS toolkits are plug-and-play platforms that allow fraudsters to create and manage phishing campaigns easily, making it accessible even for those with limited technical skills. They provide features like customizable phishing templates, infrastructure, and other tools to facilitate credential theft and circumvent multi-factor authentication using adversary-in-the-middle (AiTM) phishing. The Windows maker said it has also spotted emails intended to trick organizations into paying bogus invoices, potentially leading to financial losses. The spoofed messages also impersonate legitimate services like DocuSign or claim to be from HR regarding salary or benefits changes. Phishing emails propagating financial scams often resemble a conversation between the CEO of the targeted organization, an individual requesting payment for services provided, or the firm's accounting department. They also contain three attached files to lend the scheme a false sense of trust - A fake invoice for thousands of dollars to be wired to a bank account An IRS W-9 form listing the name and social security number of the individual used to set up the bank account A fake bank letter was allegedly provided by an employee at the online bank used to set up the fraudulent account "They may employ clickable links in the email body or QR codes in attachments or other means of getting the recipient to navigate to a phishing landing page," it added. "The appearance of having been sent from an internal email address is the most visible distinction to an end user, often with the same email address used in the 'To' and 'From' fields." To counter this risk, organizations are advised to set strict Domain-based Message Authentication, Reporting, and Conformance (DMARC) reject and Sender Policy Framework (SPF) hard fail policies and properly configure third-party connectors, such as spam filtering services or archiving tools. It's worth noting that tenants with MX records pointed directly to Office 365 are not vulnerable to the attack vector. Additionally, it's recommended to turn off Direct Send if not necessary to reject emails spoofing the organization's domains.

The rise of the Tycoon 2FA phishing kit should serve as a global warning siren for every enterprise. This is not a tool for elite hackers. This is a turnkey kit that anyone with a browser can use to bypass the very MFA and auth apps companies depend on. And it is being used at scale. Over 64,000 attacks have already been tracked this year, many targeting Microsoft 365 and Gmail because those platforms represent the easiest, fastest path into an enterprise. Phishing as a Service, No Skill Required Tycoon 2FA’s power comes from removing the need for technical skill. It is Phishing as a Service, fully packaged, polished, and automated. A teenager who cannot write a line of code can deploy it. The kit walks the operator through setup. It provides fake login pages. It spins up reverse proxy servers. It does all the heavy lifting. The attacker simply sends a link to hundreds of your employees and waits for one to bite. Real-Time MFA Relay and Total Session Takeover Once the victim clicks, Tycoon 2FA does the rest. It intercepts usernames and passwords in real time. It captures session cookies. It proxies the MFA flow directly to Microsoft or Google. The victim thinks they are simply passing a security check, but they are authenticating the attacker. This is the terrifying part. Even well-trained users fall for this because everything looks pixel perfect identical. The pages are dynamic, pulling live responses from legitimate servers. If Microsoft says enter your code, the page updates instantly. If Google sends a prompt, it appears exactly as expected. There is no visible difference. There is no clue. And there is no way for any legacy MFA or authenticator app to stop it because Tycoon is man in the middle by design. Built to Evade Detection It gets worse. Tycoon 2FA includes anti detection layers that rival commercial malware strains. Base64 encoding. LZ string compression. DOM vanishing. CryptoJS obfuscation. Automated bot filtering. CAPTCHA challenges. Debugger checks. The kit hides itself from scanners and researchers. It only reveals its true behavior when a human target arrives. And once it completes the authentication relay, the attacker gets full session access inside Microsoft 365 or Gmail. From there they move laterally into SharePoint, OneDrive, email, Teams, HR systems, finance systems. One successful phish creates total compromise. The ebook “CISO Guide: Stopping Ransomware with Next-Gen MFA” explores how ransomware attacks are evolving and why legacy MFA can’t keep up. This essential guide reveals the real-world impact of phishing-resistant MFA, how it stops ransomware before damage is done, and why CISOs are making the switch to biometric phishing proof identity. Read the CISO Guide Legacy MFA Has Already Collapsed This is why legacy MFA has collapsed. You just rolling that out makes your company a honeypot. SMS codes. Push notifications. TOTP apps. All share the same flaw. They rely on user behavior. They depend on the hope that a user notices something is wrong. They offer attackers shared secrets that can be intercepted, forwarded, or replayed. Tycoon 2FA and dozens of similar kits exploit exactly that. They turn the user into the attack vector. Even passkeys are proving vulnerable when synced through cloud accounts or when fallback recovery paths exist that can be socially engineered. Attackers understand this completely. Criminal groups like Scattered Spider, Octo Tempest, and Storm 1167 are using these kits daily. It is the fastest growing attack method in the world because it is easy, scalable, and requires no technical sophistication. Companies are rolling out MFA and authenticator apps only to find out these systems collapse the moment a phishing kit decides to target them. The truth is simple. If someone can trick your employee into entering a code or approving a prompt, the attacker wins. And Tycoon does exactly that. The Path Forward: Phishing-Proof MFA But there is a path forward and it is fast and easy to roll out. Biometric phishing proof identity built on FIDO2 hardware. Authentication that is proximity based, domain bound, and impossible to relay or spoof. A system where there are no codes to enter, no prompts to approve, no shared secrets to intercept, and no way to trick the user into helping the attacker. A system that rejects fake websites automatically. A system that forces a live biometric fingerprint match on a physical device that must be near the computer being logged into. This changes everything because it removes the user from the decision tree. Instead of hoping someone recognizes a fake login page, the authenticator itself checks the origin cryptographically. Instead of hoping someone refuses a malicious push request, the authenticator never receives a push request at all. Instead of asking people to be perfect, the system verifies identity with hardware, not judgment. The Token Model This is the model behind Token Ring and Token BioStick. Phishing proof by architecture. Biometric by requirement. Proximity based by default. Domain bound by cryptography. There is no code to steal. There is no approval to trick. There is no recovery flow for a scammer to exploit. Even if a user clicks the wrong link. Even if a user hands over a password (if they even have one). Even if a social engineer calls pretending to be IT. The authentication simply fails because the domain does not match and the fingerprint is not present. Tycoon 2FA hits a wall. The relay breaks. The attack dies instantly. And these solutions are inexpensive and available today. Enterprises using these devices report something important. Employees comply easily with this passwordless wireless solution. Authentication is fast (2 seconds). There is nothing to remember. Nothing to type. Nothing to approve. It is a better user experience and a vastly stronger security posture. When identity is bound to a physical biometric device that enforces origin checks and proximity requirements, phishing kits become irrelevant. The Reality Every Enterprise Must Face This is the moment every enterprise must accept. The attackers have evolved and the defenses must evolve too. Legacy MFA cannot survive this threat. Authenticator apps cannot survive this threat. Passkeys struggle under it. Tycoon 2FA proves that any system asking users to enter or approve anything can be defeated in seconds. Here is the truth in plain language. If your MFA can be fooled by a fake website, it is already compromised. If your authentication can be relayed, it will be. If your system depends on user judgment, it will fail. Biometric hardware based identity that is phishing proof, proximity bound, and domain locked is the only way forward. The criminals have upgraded. Now it is your turn. Upgrade your identity layer before Tycoon or its successors make you the next headline. Token products are now available online: https://store.tokenring.com Sponsored and written by Token.

Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for "AcridRain") Stealer, which was available under the malware-as-a-service (MaaS) model until sales of the malware were suspended in mid-July 2024. Amatera is available for purchase via subscription plans that go from $199 per month to $1,499 for a year. "Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services," the Canadian cybersecurity vendor said. "Notably, Amatera employs advanced evasion techniques such as WoW64 SysCalls to circumvent user-mode hooking mechanisms commonly used by sandboxes, Anti-Virus solutions, and EDR products." As is typically the case with ClickFix attacks, users are tricked into executing malicious commands using the Windows Run dialog in order to complete a reCAPTCHA verification check on bogus phishing pages. The command initiates a multi-step process that involves using the "mshta.exe" binary to launch a PowerShell script that's responsible for downloading a .NET downloaded from MediaFire, a file hosting service. The payload is the Amatera Stealer DLL packed using PureCrypter, a C#-based multi-functional crypter and loader that's also advertised as a MaaS offering by a threat actor named PureCoder. The DLL is injected into the "MSBuild.exe" process, following which the stealer harvests sensitive data and contacts an external server to execute a PowerShell command to fetch and run NetSupport RAT. "What is particularly noteworthy in the PowerShell invoked by Amatera is a check to determine if the victim machine is part of a domain or has files of potential value, e.g., crypto wallets," eSentire said. "If neither is found, NetSupport is not downloaded." The development dovetails with the discovery of several phishing campaigns propagating a wide range of malware families - Emails containing Visual Basic Script attachments that masqueraded as invoices to deliver XWorm by means of a batch script that invokes a PowerShell loader Compromised websites injected with malicious JavaScript that redirects site visitors to bogus ClickFix pages mimicking Cloudflare Turnstile checks to deliver NetSupport RAT as part of an ongoing campaign codenamed SmartApeSG (aka HANEYMANEY and ZPHP) Using fake Booking.com sites to display fake CAPTCHA checks that employ ClickFix lures to run a malicious PowerShell command that drops a credential stealer when executed via the Windows Run dialog Emails spoofing internal "email delivery" notifications that falsely claim to have blocked important messages related to outstanding invoices, package deliveries, and Request for Quotations (RFQs) in order to trick recipients into clicking on a link that siphons login credentials under the pretext of moving the messages to the inbox Attacks using phishing kits named Cephas (which first emerged in August 2024) and Tycoon 2FA to lead users to malicious login pages for credential theft "What makes Cephas noteworthy is that it implements a distinctive and uncommon obfuscation technique," Barracuda said in an analysis published last week. "The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods."

The phishing platform “Whisper 2FA” has rapidly become one of the most active tools used in large-scale credential theft campaigns, according to new research from Barracuda. Since July 2025, the platform has been responsible for nearly one million phishing attacks targeting accounts across multiple industries, placing it just behind Tycoon and EvilProxy in the global phishing-as-a-service (PhaaS) landscape. What makes Whisper 2FA stand out is its use of AJAX, a web technology that allows real-time communication between browser and server without page reloads. This enables the phishing kit to repeatedly capture credentials and multi-factor authentication (MFA) codes until it obtains a valid token. Unlike typical phishing kits that stop after stealing a password, Whisper 2FA continuously loops through attempts, effectively bypassing MFA protections. Attackers have been using a range of lures to deliver Whisper 2FA, mimicking brands such as DocuSign, Adobe and Microsoft 365. These phishing emails often use urgent pretexts, such as invoices or voicemail notifications, to prompt users to log in and unknowingly submit their details to attackers. Rapid Evolution and Obfuscation Techniques Barracuda’s analysis shows the kit is evolving at remarkable speed. Early variants featured visible code comments and light obfuscation. “The Whisper 2FA phishing kit is evolving rapidly in both technical complexity and anti-detection strategies,” the firm warned. Current versions remove readable text, add dense Base64 and XOR encoding layers, and include multiple anti-debugging features that disable shortcuts like Ctrl+Shift+I or right-click functions. The latest variants also employ an “infinite debugger loop,” freezing browsers if developers attempt to inspect the phishing page. Once active, the kit can validate stolen login codes instantly through the attackers’ command-and-control (C2) systems, turning the process into a live relay between victim and attacker. A typical Whisper 2FA attack follows several stages: Credential collection through a realistic login form Background exfiltration of email and password data An MFA prompt that requests a one-time code Real-time validation of the code through the attacker’s backend Each phase is designed to mimic legitimate authentication processes while invisibly transmitting stolen data. A New Generation of Phishing-as-a-Service Barracuda researchers describe Whisper 2FA as a sign of how PhaaS operations have matured. The kit combines simplicity for attackers with complex evasion for defenders. By removing the need for reverse proxies and using lightweight AJAX requests, Whisper 2FA becomes harder to detect and easier to deploy. “The Whisper 2FA phishing campaign demonstrates how phishing kits have evolved from simple credential stealers into sophisticated, full-service attack platforms,” Barracuda said. “This level of sophistication reflects the rise of Phishing-as-a-Service (PhaaS), where kits are professionally developed, regularly updated and sold or leased to attackers.” Experts recommend that organizations strengthen defenses through layered security, phishing-resistant MFA and continuous threat monitoring to counter the rise of advanced kits like Whisper 2FA.

New techniques have been developed within the Tycoon phishing kit to hide malicious links in email attacks, researchers from Barracuda have warned. The use of URL encoding, among other new techniques, are designed to better obscure, muddle and disrupt the structure of malicious links. “This is intended to confuse automated detection systems and ensure the links aren’t blocked,” the researchers noted. Tycoon’s evolution comes in response to improved capabilities of email security tools to detect and block dangerous links, Barracuda added in the report, published on September 3. “Attackers are constantly inventing new and more sophisticated ways to disguise dangerous links in phishing emails. They use tricks with spaces, symbols and web addresses in a way that looks trustworthy at first glance. These methods make it much harder for people – and traditional security software – to tell if they are being lured to a risky website,” the researchers commented. Tycoon is a Phishing-as-a-Service (PhaaS) platform available for cybercriminals to hire on the dark web. It offers advanced capabilities, including tools to bypass detection and multi-factor authentication (MFA). New Link Obfuscation Capabilities URL Encoding The Barracuda researchers observed new URL encoding techniques in phishing emails masquerading as voicemail messages from a trusted accounting service. The URL encoding used in the fake voicemail link inserted a series of invisible spaces into the web address, using the code ‘%20’. This is designed to push the malicious part of the link out of sight of security scans. It also added odd characters, including a Unicode symbol that looks like a dot but isn’t one. Additionally, a hidden email address or special code was observed being included at the end of the web address. “By using unexpected and unusual codes and symbols and making the visible web address look less suspicious and more like a normal website, the encoding technique is designed to trick security systems and make it harder for recipients and traditional filters to recognize the threat,” the researchers wrote. The Tycoon attacks also include a fake CAPTCHA verification stage before redirecting the victim to the attacker-controlled website. This is designed to make the website appear more legitimate and bypass basic security checks. Redundant Protocol Prefix Technique Tycoon phishing attacks also utilized the Redundant Protocol Prefix technique, which involves crafting a URL that is only partially hyperlinked or contains invalid elements. Examples include ‘https’ or no ‘//’ in the link. This approach aims to hide the real destination of the link while ensuring the active part looks benign and legitimate and doesn’t arouse suspicion among targets or their browser controls. Another approach is using the ‘@’ symbol in a web address. This is because everything before the ‘@’ is treated as ‘user info’ by browsers, therefore the attackers put something that looks reputable and trustworthy in this part, such as ‘office365’. The link’s actual destination comes after the ‘@’ symbol. Subdomain Abuse Another approach used to obfuscate malicious links in Tycoon attacks again involved a benign/malicious split, this time for subdomains. The attackers created fake websites using names seemingly linked to well-known companies, such as 'office365Scaffidips.azgcvhzauig.es.' This makes the user think it is dealing with a Microsoft subdomain, but the last part of the web address is an attacker-owned phishing site.

Cybercriminals are getting personal, and it’s working Cybercriminals are deploying unidentifiable phishing kits (58% of phishing sites) to propagate malicious campaigns at scale, indicating a trend towards custom-made or obfuscated deployments, according to VIPRE Security. These phishing kits can’t easily be reverse-engineered, tracked, or caught. AI makes them affordable, too. Among the most prevalent are Evilginx (20%), Tycoon 2FA (10%), 16shop (7%), with another 5% attributed to other generic kits. Manufacturing is the top target sector For the sixth quarter in a row, the manufacturing sector remains the prime target for cybercriminals. In Q2 2025, manufacturers faced the highest volume of email-based attacks, 26% of all incidents, encompassing BEC, phishing, and malspam threats. Retail follows, accounting for 20% of attacks, with healthcare close behind at 19%, reflecting a consistent trend observed since last year and through Q1 2025. According to the 2025 Verizon Data Breach Investigations Report, phishing was the entry point in 16% of cases. Credential theft led with 22%, followed by vulnerability exploitation at 20%. While phishing may not be the top method on paper, it often plays a major role in how attackers steal credentials in the first place. This means its impact is larger than it may appear. By focusing on reducing email-based threats, manufacturers could lower their overall risk of cyber compromise. BEC targets Scandinavia Scandinavian countries, known for their sophisticated economies and digital infrastructures, have become prime targets for business email compromise (BEC) attacks. Cybercriminals are increasingly focusing on executives in this region, leveraging language and localisation for greater effectiveness. While English-speaking executives remain the most targeted for BEC emails (42%), a significant portion are Danish (38%), with the Swedish and Norwegian comprising a combined 19%. The strategic use of Danish, Swedish, and Norwegian languages in BEC scams highlights a growing trend toward regional targeting. Although English proficiency is high in Scandinavia, critical corporate communications, especially within HR, finance, and executive teams, often take place in native languages, making localised attacks more convincing. Impersonation is the most common technique used in BEC scams, with 82% of attempts targeting CEOs and executives. The remaining impersonation efforts are aimed at directors and managers, HR personnel, IT staff, and school heads. Malware family of the quarter Lumma Stealer is the most encountered malware family found in the wild during Q2. Analysis shows that it is often delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on compromised or legitimate-looking cloud services such as OneDrive, and Google Drive. Lumma Stealer is sold as Malware-as-a-Service (MaaS), making it accessible to a broad range of cybercriminals. With active developer support and low cost, it is proving attractive to both novices and experienced cybercriminals. How attackers lure us in? Financial lures representing 35% of the samples, emails regarding money, financial errors, fiduciary imperatives, and such, are the number one ploy used by cybercriminals to get users to open malicious emails. Urgency-based messaging is the second most tried approach, followed by account verification and updates, travel-themed messages, package delivery, and legal or HR notices. For phishing delivery, 54% of cybercriminals leveraged open redirect mechanisms, with legitimate-looking links hosted on marketing services, email tracking systems, and even security platforms to mask the true malicious destination. Compromised websites (30%) are the next most prevalent link delivery method, followed by the use of URL shorteners (7%). While PDFs (64%) remain the preferred vehicle for delivering malicious attachments, an increasing number now feature embedded QR codes designed to carry out attacks. Finally, cybercriminals are finishing off their attacks with various exploitation mechanisms, the most observed being HTTP POST to remote server accounting (52%) and email exfiltration (30%). “Threat actors are outsmarting humans through hyper-personalised phishing techniques using the capability of AI and deploying at scale,” said Usman Choudhary, Chief Product and Technology Officer, VIPRE Security Group.

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies, including RingCentral, SharePoint, Adobe, and Docusign," Proofpoint said in a Thursday report. The ongoing campaign, first detected in early 2025, is designed to use the OAuth applications as a gateway to obtain unauthorized access to users' Microsoft 365 accounts by means of phishing kits like Tycoon and ODx that are capable of conducting multi-factor authentication (MFA) phishing. The enterprise security company said it observed the approach being used in email campaigns with more than 50 impersonated applications. The attacks begin with phishing emails sent from compromised accounts and aim to trick recipients into clicking on URLs under the pretext of sharing requests for quotes (RFQ) or business contract agreements. Clicking on these links directs the victim to a Microsoft OAuth page for an application named "iLSMART" that asks them to grant it permissions to view their basic profile and maintain continued access to the data that they have been granted access to. What makes this attack notable is the impersonation of ILSMart, a legitimate online marketplace for aviation, marine, and defense industries to buy and sell parts and repair services. "The applications' permissions would provide limited use to an attacker, but it is used for setting up the next stage of the attack," Proofpoint said. Regardless of whether the target accepted or denied the permissions requested, they are first redirected to a CAPTCHA page and then to a phony Microsoft account authentication page once the verification is complete. This fake Microsoft page makes use of adversary-in-the-middle (AitM) phishing techniques powered by the Tycoon Phishing-as-a-Service (PhaaS) platform to harvest the victim's credentials and MFA codes. As recently as last month, Proofpoint said it detected another campaign impersonating Adobe in which the emails are sent via Twilio SendGrid, an email marketing platform, and are engineered with the same goal in mind: To gain user authorization or trigger a cancellation flow that redirects the victim to a phishing page. The campaign represents just a drop in the bucket when compared to overall Tycoon-related activity, with the multiple clusters leveraging the toolkit to perform account takeover attacks. In 2025 alone, attempted account compromises affecting nearly 3,000 user accounts spanning more than 900 Microsoft 365 environments have been observed. "Threat actors are creating increasingly innovative attack chains in an attempt to bypass detections and obtain access to organizations globally," the company said, adding it "anticipates threat actors will increasingly target users’ identity, with AiTM credential phishing becoming the criminal industry standard." As of last month, Microsoft has announced plans to update default settings to improve security by blocking legacy authentication protocols and requiring admin consent for third-party app access. The updates are expected to be completed by August 2025. "This update will have a positive impact on the landscape overall and will hamstring threat actors that use this technique," Proofpoint pointed out. The disclosure follows Microsoft's decision to disable external workbook links to blocked file types by default between October 2025 and July 2026 in an attempt to enhance workbook security. The findings also come as spear-phishing emails bearing purported payment receipts are used to deploy by means of an AutoIt-based injector a piece of .NET malware called VIP Keylogger that can steal sensitive data from compromised hosts, Seqrite said. Over the course of several months, spam campaigns have been spotted concealing installation links to remote desktop software inside PDF files so as to bypass email and malware defenses. The campaign is believed to have been ongoing since November 2024, primarily targeting entities in France, Luxembourg, Belgium, and Germany. "These PDFs are often disguised to look like invoices, contracts, or property listings to enhance credibility and lure victims into clicking the embedded link," WithSecure said. "This design was intended to create the illusion of legitimate content that has been obscured, prompting the victim to install a program. In this case, the program was FleetDeck RMM." Other Remote Monitoring and Management (RMM) tools deployed as part of the activity cluster include Action1, OptiTune, Bluetrait, Syncro, SuperOps, Atera, and ScreenConnect. "Although no post-infection payloads have been observed, the use of RMM tools strongly suggests their role as an initial access vector, potentially enabling further malicious activity," the Finnish company added. "Ransomware operators in particular have favoured this approach."