TechOwl | Tycoon 2FA: AiTM Phishing-as-a-Service

Executive Summary

Tycoon 2FA was a $120/month phishing-as-a-service (PhaaS) platform operated by Storm-1747 that used adversary-in-the-middle (AiTM) reverse proxies to bypass MFA on enterprise identity providers including M365, Outlook, Gmail, and SharePoint. The platform targeted 500,000+ organizations monthly, harvested 264,000+ plaintext passwords, and at its peak accounted for 62% of all phishing traffic blocked by major cloud providers.

On March 4, 2026, a coordinated operation involving industry partners, Cloudflare, Europol, and six national law enforcement agencies dismantled the infrastructure — seizing 330 domains and purging 24,000 domain zones from Cloudflare. No arrests were made.

Dark web monitoring confirms that successor platforms — STARKILLER, ph1shy, and FishScale — were already operational before the takedown and immediately filled the market vacuum. The PhaaS AiTM threat model remains active.

T1566.002 - Spearphishing Link T1598.003 - Phishing for Information T1056.004 - Input Capture: Credential API Hooking T1187 - Forced Authentication T1111 - MFA Interception T1550.001 - Use Alternate Authentication Material

TYCOON 2FA — BY THE NUMBERS

$120

Subscription Price

500K+

Orgs Targeted/Month

264K

Passwords Stolen

30K+

Phishing Domains

62%

Phishing Market Share

MFA Limitations Against AiTM

Traditional MFA (SMS, TOTP, push notification) authenticates the user to the identity provider, but does not verify that the user is communicating directly with the legitimate service. AiTM phishing exploits this by positioning a reverse proxy between the victim and the real login page. The victim completes authentication normally — the proxy intercepts the credentials, MFA token, and the resulting session cookie in real-time.

This is not a misconfiguration. It is an architectural limitation of any MFA method that does not cryptographically bind authentication to the specific origin domain. The PhaaS industry exists because this limitation is commercially exploitable at scale.

99%

Orgs faced ATO attempts

59%

Compromised had MFA on

$120

Cost to bypass MFA

3 yrs

Operated uninterrupted

Platform Overview

Service Model

Tycoon 2FA operated as a subscription-based PhaaS platform. At $120/10 days ($350/month), operators received access to an admin panel with pre-built phishing templates for major enterprise platforms (M365, Outlook, Gmail, SharePoint). The platform handled AiTM credential interception, automatic MFA bypass, session cookie theft, Telegram bot forwarding of harvested credentials, and campaign analytics. Distribution was via Telegram and Signal channels with dedicated customer support and changelogs.

Threat Actor Profile

Attribute	Value
Threat Actor	Storm-1747
Developer	Saad Fridi (Pakistan)
Handles	SaaadFridi, Mr_XaaD, Tycoon Group
Active Since	August 2023
Operators	2,000+ subscribers
Domains Deployed	30,000+
Messages (Feb 2026)	3,000,000+
Market Share (mid-2025)	62% of blocked phishing traffic
Related Platform	Dadsec OTT

Victim Impact

500K+

Orgs targeted monthly

173K+

Emails harvested

264K

Plaintext passwords

328K

Total victim records

80%

Corporate domains

179K

US victims alone

Industry	% Targeted
Technology	85%
Financial Services	84%
Healthcare	83%
Manufacturing	83%
Business Services	82%

Attack Chain

Attack Chain Detail

Stage 1 — Initial Access: Phishing email delivers a PDF, SVG, HTML, or DOCX attachment embedding a QR code or link. Messages are frequently sent from previously compromised accounts (ATO chaining), bypassing sender reputation checks.

Stage 2 — Bot Filtering: Cloudflare Turnstile CAPTCHA challenge blocks automated security scanners, bots, and sandbox analysis. Only human visitors proceed to the phishing page.

Stage 3 — Anti-Analysis: Client-side JavaScript fingerprints the browser environment. Checks include navigator.webdriver detection, PhantomJS and Burp Suite identification, and dev tools suppression (right-click, F12, Ctrl+U disabled). If any operation exceeds 100ms — indicating debugger attachment — the page redirects to Amazon.com.

Stage 4 — AiTM Proxy: An enterprise login page renders using the target organization's actual IdP branding. The phishing page is a Cloudflare Workers-hosted reverse proxy sitting between the victim and the real authentication servers. All interactions are proxied in real-time.

Stage 5 — Credential & Session Capture: The victim enters credentials and completes MFA normally. The proxy captures the password, MFA token, and session cookie simultaneously. The attacker obtains a fully authenticated session. Password resets alone do not remediate the compromise — the session cookie remains valid.

Stage 6 — Post-Capture Redirect: The victim is shown a fake "Sign-In Blocked" error page and disengages. The attacker retains full session access to the victim's mailbox and connected services.

Takedown and What Replaced It

On March 4, 2026, a coordinated operation by industry partners, Cloudflare, Europol, and law enforcement agencies across six countries dismantled the Tycoon 2FA infrastructure — seizing 330 domains, purging 24,000 domain zones, and terminating all active Workers scripts. No arrests were made. Developer Saad Fridi remains at large.

The disruption eliminated Tycoon 2FA, but the AiTM phishing market did not stop. Multiple platforms were already operational before the takedown and immediately absorbed the displaced demand.

STARKILLER V6.0.1

Posted on exploit.in on January 16, 2026 (six weeks pre-takedown) by Jinkusu01 (account created January 14, 2026). STARKILLER uses a different architecture than traditional AiTM proxies: it launches actual Chromium browsers inside Docker containers, rendering target websites live. Capabilities include real-time browser mirroring, VNC-based victim monitoring, keystroke logging, geolocation tracking, and full C2 control. Bypasses SMS, TOTP, push notifications, and hardware security keys when proxied through the live browser session.

ph1shy v2.0.0

Posted on BreachForums on February 10, 2026 (three weeks pre-takedown) by ph1shyfam. Built with Golang backend and React frontend. Pricing: $1,500 one-time license, $10,000 for source code (crypto only). At the time of the forum post, a live Coinbase phishing template was actively running with a victim connected in the demo.

FishScale

Advertised on exploit.in by ZloyNginR (account active since April 2023). FishScale is a Golang-based reverse proxy marketed as a more capable alternative to Evilginx. Features include WAF bypass, request cloaking, and DDoS protection. This platform was not a post-takedown successor — it operated concurrently with Tycoon 2FA.

Key Finding

The takedown created a market vacuum that was filled within days. STARKILLER, ph1shy, FishScale, and session cookie sellers were already operational before the disruption and immediately absorbed displaced demand.

Defensive Countermeasures

Traditional MFA (SMS, TOTP, push) does not defend against AiTM because authentication is completed successfully — the proxy intercepts the resulting session token. Effective defenses must either prevent credential submission to non-legitimate origins or invalidate stolen session tokens.

Defender's Checklist

Mitigation Matrix

☐ FIDO2 / Passkeys: Cryptographic authentication bound to the exact origin domain. If the authentication request originates from a proxy domain, the key will not respond — domain mismatch at the cryptographic level. Prevents credential submission to phishing pages entirely.

☐ Token Binding / Proof-of-Possession: Session tokens cryptographically bound to the originating device. Stolen tokens cannot be replayed from a different machine. Token Protection in Entra ID is one implementation of this for enterprise sessions. Invalidates stolen session cookies.

☐ Conditional Access Policies: Enforce device compliance, location restrictions, network trust, and risk-level requirements. Block residential proxies and VPNs (75% of Tycoon 2FA operators used residential proxies). Require device certificates that the proxy cannot provide. Blocks authentication from untrusted devices/locations.

☐ Continuous Access Evaluation (CAE): Sessions continuously validated against real-time risk signals. IP changes, impossible travel, and anomalous behavior trigger near-real-time token revocation, not deferred to the next token refresh. Terminates compromised sessions in near-real-time.

☐ User Awareness Training: Do not authenticate via email-embedded links. Report unexpected MFA prompts. Treat QR codes in emails as suspicious. Verify the browser URL bar shows the legitimate domain before entering credentials. Prevents initial click-through.

FIDO2 / Passkeys         → Prevents credential submission to phishing pages
Token Binding             → Invalidates stolen session cookies
Conditional Access        → Blocks auth from untrusted devices/locations
Continuous Evaluation     → Terminates compromised sessions in near-real-time
User Awareness            → Prevents initial click-through

Recommendation

No single control is sufficient. A layered deployment of FIDO2, token binding, conditional access, and CAE is required to make AiTM phishing economically unviable for operators.

Indicators of Compromise

Malicious Domains

        serviciosdrc[.]com • agousa[.]org • hpcbjoukzdlx[.]es • wvhjkdig[.]ru • hrcbods[.]es • qkmuadvkc[.]es • rkbfoavkwgn[.]es • djxrc[.]ru • kfrutc[.]ru • uywwpjlanfv[.]ru • ifelse[.]rlcozx[.]es • tycoongroup[.]ws • codecrafters[.]su • codecrafterspro[.]com • devcraftingsolutions[.]com
    

SHA256 Hashes (HTML Structure)

        c46289f3f7c486d684783ec50a01a437252eabd0159e7efd7594afcaf242c7bb

        9f6d91dda0a3c4d5054e78e90f30d2f0c98c79a03cb16d58819f0cb58d9c3abb

        66a5b9c0d963dd910a502749eec42d6660b27aafa09b9ce01d73e3f73754b707

        0499fdfcb2fddfd2e5d3f3eab2910ff2854208a8140e514cf5f1f39e12b7c55b

Infrastructure Fingerprints

        Banner hash: 1dacabac954305393d5bbe24713cb281

        HTML signature: 3c0af39ecb3753c5fee3b53d063c7286019eac3b

        CSS fingerprint: pages-godaddy.css + pages-okta.css

        JS pattern: _myscr[0-9]{6}.js

        PHP endpoint: res444.php

MITRE ATT&CK Techniques

Conclusion

The Tycoon 2FA takedown demonstrates both the effectiveness and limitations of coordinated disruption operations. The infrastructure was eliminated — 24,000 domains purged, 330 domains seized, bulletproof hosting degraded. However, no arrests were made, and the underlying AiTM threat model remains commercially viable.

Dark web monitoring confirms that successor platforms (STARKILLER, ph1shy, FishScale) were already operational before the takedown. The PhaaS ecosystem operates as a market economy — when one supplier is disrupted, demand migrates to alternatives, often with improved capabilities.

Organizations relying solely on traditional MFA remain vulnerable to AiTM phishing regardless of Tycoon 2FA's status. Migration to phishing-resistant authentication (FIDO2/passkeys), combined with token binding and continuous access evaluation, is required to address the architectural limitation that the PhaaS industry exploits.