中文 EN
Login Register
C
CrowdStrike 2026-03-20
Industry Signal Impact: Important Strength: High Conf: 90%

CrowdStrike Discloses Tycoon2FA Phishing-as-a-Service Platform Remains Active

Summary

CrowdStrike's threat intelligence team reveals Tycoon2FA Phishing-as-a-Service platform uses reverse proxy architecture to intercept user sessions in real-time, bypassing two-factor authentication. The service operates on a subscription model offering customized phishing pages and automated tools, linked to multiple attack campaigns.

Key Takeaways

CrowdStrike discloses that the Tycoon2FA Phishing-as-a-Service platform remains active after law enforcement actions. The platform employs reverse proxy architecture to intercept and forward user sessions with legitimate sites like Microsoft 365 in real-time, bypassing time-based one-time password two-factor authentication.

The service operates on a subscription model offering customized phishing pages, automated tools, and customer support. Attackers use it to steal credentials and session tokens for account takeover and subsequent breaches. CrowdStrike has observed the platform associated with multiple attack campaigns.

Why It Matters

This disclosure highlights the persistence of commercialized low-barrier phishing threats, driving security vendors to enhance identity protection and session security detection capabilities.

Source: CrowdStrike Newsroom
View Original →

Get 3-5 key AI infrastructure signals weekly →

💬 Comments (0)