VERY IMPORTANT

This report provides an in-depth analysis of Tycoon 2FA, an Adversary-in-The-Middle phishing kit distributed as a Phishing-as-a-Service platform. It became widespread since August 2023 and is currently massively used in phishing campaigns mainly targeting Microsoft 365 accounts. Our analysis revealed recent changes enhancing its stealth capabilities. We identified tracking opportunities to monitor this threat and will continue investigating Tycoon 2FA infrastructure.