New phishing tool targets Microsoft 365 and Gmail accounts

A new phishing toolkit called Tycoon 2FA that is capable of tricking and taking over even well-protected accounts is targeting Microsoft 365 and Gmail accounts.

Although two-factor authentication (2FA) is considered a safe security method, a new set of phishing tools can bypass this layer of security and threaten accounts.

The security research team at Sekoia Threat Detection & Research said that the Tycoon 2FA toolkit uses the "Adversary-in-the-Middle" Phishing toolkit to deceive users, acting as a platform. Popular Phishing-as-a-Service (PhaaS) platform on private Telegram channels.

The attacker will send the user an email containing a QR code or a link to a fake website. When the victim interacts with the link or QR code, the website triggers Cloudflare security checks. Users tend to ignore this because it is quite common nowadays.

The victim will then be directed to a fake Microsoft page asking to enter login information. If the victim complies, the bad guys will steal the login name and password. Tycoon 2FA will then display a fake 2FA page, asking to verify the user's identity.

According to researchers, to bypass security measures, criminals will intercept and keep 2FA tokens. This login cookie will be stolen and can be reused at any time, easily bypassing the account's 2FA protection.

Experts warn users to keep a few things in mind to protect themselves from phishing attacks.

1. Be careful with unfamiliar emails: Do not click on any links or QR codes in unfamiliar emails.
2. Double check the website address: Before entering your login information, double check that the website address matches the official Microsoft website or Gmail.
3. Use strong passwords: Use strong and different passwords for each account. You should change your password regularly.
4. Enabling two-factor authentication (2FA) helps protect accounts even if an attacker gets hold of the password.
5. Always update anti-virus and security software on your device.

Jessica Tanner

Update 03 April 2024