Cybercriminals are increasingly leveraging sophisticated Adversary-in-the-Middle (AiTM) phishing techniques, enabled by the rise of Phishing-as-a-Service (PhaaS) ecosystems.
These operations target financial institutions globally, bypassing multi-factor authentication (MFA) by intercepting live authentication sessions.
Threat actors use reverse proxy servers to relay user inputs to legitimate websites, capturing credentials and session cookies in real time.
This allows attackers to hijack accounts even after MFA is completed.
Prominent AiTM phishing kits such as Tycoon 2FA and Sneaky 2FA have gained traction, with Tycoon emerging as the most widespread kit in recent years.
These kits are distributed under the PhaaS model, which lowers entry barriers for cybercriminals and enables scalable attacks against high-value targets, particularly in the financial sector.
By mimicking login portals and leveraging compromised infrastructure, these campaigns have become increasingly difficult for users to detect.
State-Sponsored Threats and Financial Espionage
Advanced Persistent Threats (APTs) linked to nation-states are exploiting vulnerabilities within financial systems for dual purposes: financial gain and intelligence gathering.
North Korea’s Lazarus Group remains a significant actor in this domain, targeting banks and cryptocurrency platforms to evade sanctions and fund its nuclear weapons program.
Recent campaigns such as VMConnect demonstrate Lazarus’ evolving tactics, including spearphishing through fake job offers that deliver backdoor malware.
Similarly, Iranian APT33 has adopted Initial Access Broker (IAB) strategies, collaborating with ransomware affiliates like BlackCat to monetize access gained from compromised networks.
Chinese groups such as APT41 have blurred the lines between espionage and profit-driven attacks by outsourcing operations to private companies that exploit access for their own financial benefit.
Ransomware Operators Escalate Attacks
Ransomware groups remain a persistent threat to financial entities, employing advanced malware and zero-day vulnerabilities to disrupt operations.
Groups like RansomHub and TA505 have targeted banks and payment processors using double extortion tactics encrypting data while threatening public disclosure of sensitive information.
RansomHub’s custom malware, EDRKillShifter, exemplifies the increasing sophistication of these campaigns by disabling endpoint detection systems to ensure success.
Additionally, ransomware actors are leveraging supply chain vulnerabilities for large-scale attacks.
For instance, TA505 exploited zero-day flaws in Cleo file transfer software during a 2024 campaign that affected multiple industries worldwide.
According to Sekoia Report, these incidents underscore the growing technical capabilities of ransomware operators and their ability to adapt quickly to emerging opportunities.
The convergence of AiTM phishing kits, state-sponsored APTs, and ransomware operators highlights an evolving cyber threat landscape targeting financial institutions.
With attackers leveraging PhaaS ecosystems and collaborating across criminal networks, the barriers to executing advanced campaigns are diminishing.
As these threats escalate in scale and complexity, financial institutions must prioritize robust cybersecurity measures to mitigate risks posed by adversaries operating at the intersection of espionage and profit-driven cybercrime.
Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response, and Threat Hunting -Â Register Here
 phishing techniques, enabled by the rise of Phishing-as-a-Service (PhaaS) ecosystems.){kind=link}