Tycoon
Tycoon is a phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) phishing kit used to steal credentials, MFA/2FA tokens, and authenticated session cookies in real time, enabling MFA bypass and account takeover. The content describes Tycoon as a broadly available platform that provides phishing kits and supporting infrastructure, lowering the barrier for multiple threat actors to conduct sophisticated phishing operations.
Observed Tycoon activity primarily targets Microsoft 365 and Microsoft Entra ID users with counterfeit Microsoft authentication pages that can display the victim organization’s Azure Active Directory/Entra branding. Reported delivery and lure methods include email, SMS, OAuth consent workflows, QR-code phishing (quishing), HR and payroll themes, employee benefits lures, file-sharing themes, request-for-quote and contract lures, and holiday-themed campaigns. In several campaigns, victims were redirected through CAPTCHA pages before reaching Tycoon-powered phishing flows. The content also links Tycoon to fake Microsoft OAuth applications impersonating brands such as Adobe, DocuSign, RingCentral, SharePoint, and industry-specific services; both Accept and Cancel actions on the OAuth consent page could redirect victims into Tycoon phishing pages.
Tycoon is associated with synchronous relay/AiTM capabilities that intercept credentials and 2FA-approved session tokens, allowing session hijacking by importing stolen cookies into an attacker-controlled browser. Proofpoint reported Tycoon-linked activity in 2025 attempting to compromise nearly 3,000 user accounts across more than 900 Microsoft 365 environments, with a confirmed success rate exceeding 50%. The kit was also referenced in campaigns abusing the Lovable AI website builder to host or redirect to phishing pages, including Microsoft-themed credential theft and banking-targeted MFA phishing. In one real-world post-compromise case, activity most likely associated with Tycoon was followed by creation of malicious mailbox rules and registration of an internal Microsoft Entra ID application for persistence.
The content notes infrastructure and evasion patterns including operation from Microsoft Azure Blob Storage, specifically alencure[.]blob[.]core[.]windows[.]net, use of CAPTCHA filtering, and a late-April 2025 shift from Russia-based proxy services to an abused U.S.-based data center hosting provider. Reported indicators and related infrastructure include redirector hxxps://azureapplicationregistration[.]pages[.]dev/redirectapp, landing domains yrqwvevbjcfv[.]es and pw5[.]haykovx[.]es, domain gmlygt[.]ru, IPv6 address 2a00:b703:fff2:35::1, receiver domain quantumdhub[.]ru, and user-agent strings axios/1.7.9 and axios/1.8.2. Additional Tycoon-related techniques mentioned include nesting a malicious QR code inside a legitimate QR code to hinder automated detection.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
The goal of the campaigns is to use OAuth applications as a gateway lure to conduct other activities, mostly to obtain access to Microsoft 365 accounts via MFA phishing.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
5 techniques
Credential Access
The page presented the user's organization Azure Active Directory (AAD) or Okta Branding and was designed to harvest user credentials, multifactor authentication (MFA) tokens, and retrieve associated session cookies.
The credential phishing page presented the user's organization AAD (Azure Active Directory) Branding once email was provided and it was designed to harvest user credentials, 2FA token, and to retrieve an associated session cookie.
The credential phishing page presented the user's organization AAD (Azure Active Directory) Branding once email was provided and it was designed to harvest user credentials, 2FA token, and to retrieve an associated session cookie.
A typical adversary-in-the-middle (AiTM) attack begins with the victim receiving a phishing message containing a link to a malicious webpage design to mimic a legitimate login page. The fake domain is connected to a reverse proxy server, which relays traffic between the victim and the actual service.
Collection
2 techniques
Collection
The page presented the user's organization Azure Active Directory (AAD) or Okta Branding and was designed to harvest user credentials, multifactor authentication (MFA) tokens, and retrieve associated session cookies.
A typical adversary-in-the-middle (AiTM) attack begins with the victim receiving a phishing message containing a link to a malicious webpage design to mimic a legitimate login page. The fake domain is connected to a reverse proxy server, which relays traffic between the victim and the actual service.
IOCs tracked for this family
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An adversary-in-the-middle phishing kit used to facilitate token/session theft during OAuth-themed phishing flows, helping attackers capture credentials/tokens and maintain access to Microsoft 365/Entra ID environments.
A phishing kit family hosted on legitimate cloud infrastructure (Microsoft Azure Blob Storage) to serve credential-harvesting pages while evading domain-reputation based detection.
Adversary-in-the-middle phishing kit used to take over Microsoft accounts; in the described incident it enabled follow-on persistence via mailbox rules and a malicious OAuth app.
An adversary-in-the-middle phishing kit associated with cloud account takeover attacks, credential and session cookie theft, and follow-on persistence via malicious OAuth application abuse.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.