Cybercriminals are using Tycoon 2FA to bypass 2FA in Microsoft 365 and Gmail software.
The use of a new phishing-as-a-service (PhaaS) platform called 'Tycoon 2FA' is gaining popularity among cybercriminals targeting Microsoft 365 and Gmail accounts in an attempt to bypass two-factor authentication (2FA) protection. Discovered by Sekoia analysts during routine threat hunting in October 2023, the PhaaS kit has been active since at least August of that year, when it was offered through private Telegram channels by the Saad Tycoon group. Similarities with other adversary-in-the-middle platforms like Dadsec OTT suggest possible code reuse or developer collaboration between them. A newer version of Tycoon, released in 2024, is said to be more surreptitious than its predecessor, indicating ongoing efforts toward improvement. Currently utilizing over a thousand domains, this service has already been used over a thousand times for phishing attacks.
Tycoon 2FA is a relatively new addition to a PhaaS market that offers cybercriminals choices. Notable platforms such as LabHost, Greatness, and Robin Banks are also capable of bypassing 2FA security measures.
The Tycoon 2FA attacks follow a multistep process where the cybercriminal uses a reverse proxy server to host their phishing page. This enables them to steal session cookies and intercept any inputs from unsuspecting users, which are forwarded onto the authentic service.
Sekoia explained to Bleeping Computer that "once the user completes the MFA challenge, and the authentication is successful, the server in the middle captures session cookies." By doing so, the cybercriminal can replay a user's session and evade multi-factor authentication (MFA) mechanisms.
Sekoia reported that the latest version of the Tycoon 2FA phishing kit, released in 2024, introduced significant modifications that improved the phishing and evasion capabilities. These changes include “updates to the JavaScript and HTML code, alterations in the order of resource retrieval, and more extensive filtering to block traffic from bots and analytical tools.”
Sekoia also reported that the scale of operations is significant, as there's proof of a wide range of cybercriminals currently using Tycoon 2FA for phishing activities.
Multifactor authentication (MFA) is a security measure requiring users to provide two or more forms of verification before accessing an account or system. MFA enhances security by adding an extra layer of protection beyond passwords, reducing the risk of unauthorized access to sensitive health information.
While not explicitly mandated by the Health Insurance Portability and Accountability Act (HIPAA), implementing MFA is considered a best practice for safeguarding electronic protected health information (ePHI) and demonstrates a commitment to patient privacy and security. By requiring multiple forms of verification, MFA helps healthcare organizations mitigate risks, control access to patient records, and maintain compliance with HIPAA regulations.
See also:
The discovery of the Tycoon 2FA phishing kit is another advance for cybercriminals. Using 2FA is widely accepted as an added layer of security, giving organizations confidence that their systems are protected from cyber threats. Cybercriminals are constantly advancing in their techniques for evading cybersecurity measures organizations implement to safeguard their data. The increasing popularity of the Tycoon 2FA phishing kit could mean 2FA is a false sense of security that is less effective than other safeguarding methods, leading organizations to rethink their security strategies.
By requiring multiple forms of verification, MFA helps mitigate risks associated with unauthorized access, data breaches, and identity theft. It helps control access to patient records and other sensitive health data, ensuring that only authorized individuals can view or modify ePHI.
A cyberattack on a healthcare organization's systems poses severe consequences for HIPAA compliance, including:
Such attacks can compromise patient data, lead to regulatory penalties, disrupt healthcare services, damage the organization's reputation, and result in legal action from affected individuals.
See also: