1. Introduction
Adversary-in-the-Middle (AiTM) phishing attacks have become one of the most effective methods for compromising modern cloud identities. Traditional security controls such as multi-factor authentication (MFA) were originally designed to prevent credential theft, but AiTM techniques allow attackers to intercept authentication sessions in real time, enabling them to bypass MFA protections entirely.
One of the most prominent platforms enabling these attacks is Tycoon2FA, a commercialized Phishing-as-a-Service (PhaaS) toolkit used by multiple threat actors worldwide. Instead of requiring advanced technical expertise, the platform provides a turnkey system that allows cybercriminals to deploy MFA-bypass phishing campaigns at scale.
The toolkit was heavily used to target cloud identity platforms such as:
- Microsoft 365
- Gmail / Google Workspace
- Other SaaS authentication portals
Through automated infrastructure and subscription-based distribution, Tycoon2FA enabled attackers to compromise large numbers of accounts and then leverage them for business email compromise (BEC), lateral phishing, data theft, and financial fraud.
2. Tycoon2FA as a Phishing-as-a-Service Ecosystem
Tycoon2FA operates as a commercial cybercrime platform, where attackers subscribe to the phishing kit and receive all required components to launch attacks.
Key characteristics of the platform:
| Feature | Description |
|---|---|
| Subscription model | Attackers pay for access to the phishing kit infrastructure |
| Telegram distribution | Sold and supported via encrypted Telegram channels |
| Ready-made templates | Fake login pages for Microsoft 365, Gmail, and other services |
| Infrastructure automation | Hosting, domain management, and credential capture |
| Session hijacking | Captures authentication cookies to bypass MFA |
The platform essentially democratizes advanced phishing attacks, enabling even low-skill actors to conduct sophisticated campaigns.
This model mirrors broader trends in cybercrime where attack capabilities are packaged as services, similar to legitimate SaaS platforms.
3. Core Attack Technique: Adversary-in-the-Middle (AiTM)
The primary technical innovation behind Tycoon2FA is its use of an AiTM reverse proxy architecture.
Unlike traditional phishing attacks that simply steal passwords, AiTM attacks proxy authentication traffic between the victim and the legitimate service.
Simplified attack workflow
- Victim receives a phishing email containing a malicious link.
- The link directs the victim to a Tycoon2FA phishing site designed to mimic the legitimate login page.
- The phishing server acts as a reverse proxy to the real authentication service.
- When the victim enters credentials:
- Credentials are forwarded to the real service.
- The service responds with an MFA challenge.
- The victim completes the MFA verification.
- The phishing proxy captures:
- credentials
- MFA tokens
- session cookies
- Attackers reuse the authenticated session cookie to access the victim’s account.
Because the authentication process is completed legitimately by the user, MFA protections do not prevent account takeover.
4. Infrastructure and Operational Design
Tycoon2FA campaigns were designed for high-volume operations, allowing attackers to run phishing infrastructure at scale.
4.1 Reverse Proxy Phishing Servers
The core component is a proxy server that sits between the victim and the legitimate login system.
Functions include:
- forwarding login requests
- intercepting authentication responses
- capturing session cookies
- logging credentials and metadata
This design allows attackers to obtain authenticated sessions instead of just passwords, making the attack significantly more powerful.
4.2 Credential and Session Harvesting
Tycoon2FA collects multiple data points during each attack:
- email address
- password
- MFA code
- session cookies
- browser information
- victim IP address
- geolocation
These artifacts enable attackers to:
- maintain persistent access
- bypass repeated MFA checks
- sell compromised sessions on underground markets.
4.3 Anti-Detection Features
To evade security researchers and automated scanning systems, Tycoon2FA incorporates several defensive mechanisms.
Examples include:
CAPTCHA gating
Phishing pages often require CAPTCHA verification before displaying the login page. This prevents automated scanners from easily collecting the phishing content.
Traffic filtering
Infrastructure may restrict access based on:
- IP reputation
- geolocation
- user-agent strings
Code obfuscation
The JavaScript and backend code used in the phishing pages is frequently obfuscated to hinder analysis.
5. Campaign Distribution and Victim Targeting
Tycoon2FA campaigns typically begin with phishing email distribution.
Common lures include:
- payroll or HR notifications
- document-sharing requests
- security alerts
- account verification prompts
- QR-code phishing (quishing)
Victims are redirected to fake authentication portals closely resembling legitimate login interfaces.
Analysis of harvested credentials shows that victims were primarily users of:
- Google webmail services (~48%)
- Microsoft Outlook / Microsoft 365 (~37%)
Geographically, victims were concentrated in:
- United States
- United Kingdom
- Canada
- India
- Australia
6. Post-Compromise Activity
Once attackers obtain authenticated sessions, several follow-on attacks become possible.
6.1 Business Email Compromise (BEC)
Compromised accounts can be used to:
- intercept financial communications
- send fraudulent payment requests
- conduct invoice scams.
6.2 Lateral Phishing
Attackers send phishing emails from compromised accounts to trusted contacts, increasing the success rate of future campaigns.
6.3 Data Exfiltration
Access to enterprise email accounts allows attackers to steal:
- confidential documents
- corporate communications
- intellectual property.
6.4 Persistence
Because session cookies are captured, attackers can remain authenticated without re-entering credentials or triggering MFA.
7. Scale and Impact
Tycoon2FA became one of the most active phishing-as-a-service platforms in operation.
Security telemetry indicates that it was responsible for large volumes of global phishing campaigns targeting enterprise cloud identities.
The platform’s operational scale demonstrates how industrialized cybercrime services can dramatically expand the reach of identity-based attacks.
8. Disruption of Tycoon2FA Infrastructure
Law enforcement and industry partners collaborated to disrupt the Tycoon2FA ecosystem.
Actions included:
- seizing malicious domains
- blocking infrastructure used for phishing campaigns
- identifying operators and affiliates.
The takedown operation targeted hundreds of domains and infrastructure components used by the platform’s operators.
This disruption represents a significant effort to weaken the cybercrime-as-a-service supply chain.
9. Defensive Recommendations
Organizations can mitigate AiTM phishing risks by implementing stronger identity security measures.
Identity Security Controls
- Phishing-resistant MFA
- FIDO2 security keys
- passkeys
- certificate-based authentication
- Conditional Access Policies
- device compliance checks
- location-based restrictions
- Session protection
- token binding
- continuous authentication monitoring
Detection Strategies
Security teams should monitor for:
- unusual login patterns
- impossible travel events
- token reuse from unfamiliar devices
- suspicious OAuth or session behavior.
User Awareness
Organizations should train users to identify phishing attempts involving:
- login verification messages
- fake document notifications
- QR-code login prompts.
10. Key Takeaways
Tycoon2FA demonstrates how cybercrime ecosystems are evolving toward scalable, service-based attack platforms.
Important lessons include:
- MFA alone is insufficient against AiTM attacks.
- Session cookie theft is a major threat to cloud identity security.
- Phishing-as-a-Service significantly lowers the barrier to entry for attackers.
- Strong identity protections must include phishing-resistant authentication mechanisms.
Tycoon2FA represents a major evolution in phishing operations. By combining AiTM techniques with a subscription-based cybercrime platform, attackers were able to bypass MFA and compromise cloud identities at global scale.
