INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Phishing platforms and infostealers linked to identity attacks surge

| 2025-07-07 12:00 CRITICAL HIGH DATA BREACH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
A 156 percent jump in cyberattacks targeting user logins has been reported, with identity attacks soaring since last year and now making up 59 percent of all investigations carried out by eSentire experts. The rise is attributed to advanced phishing kits and info-stealing malware, particularly phishing-as-a-service platforms such as Tycoon 2FA that offer convincing pre-made phishing pages for major workplace platforms at a relatively low cost of $200-300 per month. These services have emerged as the dominant phishing tool since its release in 2023, with over 2,000 monthly subscribers, and are capable of stealing session cookies and bypassing MFA. The attacks often lead to business email compromise (BEC) schemes and ransomware disasters, which can result in significant financial losses for organizations, with figures from last year showing costs exceeding $10-digit range.
Technical Mitigations AI-generated
• Block phishing pages from Tycoon 2FA, specifically those with URLs containing the "Tycoon" domain. • Monitor for logs gathered by info-grabbing malware and look for padding of old credentials to avoid using them as a primary tool for launching BEC or ransomware attacks. • Implement regular updates to counter adversary-in-the-middle (AitM) functions in phishing-as-a-service platforms like Tycoon 2FA.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider
Target & Sectors
Global Scope financefinance
Incident Timeline
‎2025/07/07
Phishing-as-a-service platforms such as Tycoon 2FA are democratizing identity attacks thanks to their sophisticated capabilities and relatively low cost.
threat_actor Scattered Spider
Figures from last year showed that BEC attacks, cases involving the impersonation of support staff a la Scattered Spider, and even investment fraud, all contributed to greater financial losses, deep into the 10-digit range.
infrastructure Microsoft 365
…-300 per month, these kinds of toolkits offer convincing pre-made phishing pages for the major workplace platforms, such as Microsoft 365 and Google Workspace, as well as adversary-in-the-middle (AitM) functions to steal session cookies and bypass…
financial 300 $ outlay
And for those who can't afford the $200-300 outlay for Tycoon 2FA, that's where infostealers come into play.
financial $10 Entities
As little as $10 can unlock access to various logs gathered by info-grabbing malware, offering a more hands-off approach to email compromise.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
…-300 per month, these kinds of toolkits offer convincing pre-made phishing pages for the major workplace platforms, such as Microsoft 365 and Google Workspace, as well as adversary-in-the-middle (AitM) functions to steal session cookies and bypass…
Metrics
financial
300
$ Outlay
And for those who can't afford the $200-300 outlay for Tycoon 2FA, that's where infostealers come into play.
Metrics
financial
10
Financial Impact
As little as $10 can unlock access to various logs gathered by info-grabbing malware, offering a more hands-off approach to email compromise.
Intelligence Sources
The Register - CSO 2025-07-07