Microsoft 365 Users Targeted by Tycoon2FA Linked Phishing Attack to Steal Credentials

A new wave of targeted phishing campaigns, linked to the Tycoon2FA group, has been identified specifically targeting Microsoft 365 users.

Security researchers have observed that these campaigns are leveraging an innovative tactic: the use of malformed URLs containing backslash characters, such as https:\\, in order to bypass conventional email security filters and evade URL-based detection mechanisms.

Despite the apparent incorrect format of the URLs, modern web browsers are still capable of parsing and resolving these links, ultimately landing victims on sophisticated credential harvesting sites.

Malformed URL Structures

The attackers’ primary innovation centers on the insertion of a backslash within URLs (https:\\) instead of the canonical forward slash (https://).

While this might seem like a typographic error or a harmless formatting issue, it presents a critical blindspot for most email security filters and automated scanners, many of which are programmed to disregard or de-prioritize malformed URL structures.

However, when users click on these links trusting that their email security systems would have filtered out anything malicious the browsers compensate for the malformed structure, interpreting the links and loading the malicious phishing landing pages as if the URL was correctly formatted.

This subtle evasion technique signifies a growing trend in the phishing threat landscape, where threat actors are increasingly adopting unconventional tactics to circumvent even the most robust security solutions deployed in modern enterprise environments.

Affected users often receive phishing emails masquerading as legitimate Microsoft notifications, such as security alerts or 2FA prompts, designed to instill a sense of urgency and lure them into clicking the deceptive links.

Tycoon2FA and PhaaS Ecosystem

At the heart of these campaigns is Tycoon2FA, a well-known threat actor or group that specializes in phishing-as-a-service (PhaaS).

Tycoon2FA has been associated with several campaigns targeting Microsoft cloud users and leveraging multi-factor authentication (2FA) prompt spamming and advanced phishing kits sometimes referred to as Storm-1575 or “phishkits” to harvest credentials.

These phishing sites are often hosted on a variety of reputable platforms such as Microsoft Azure, Cloudflare Workers, and even Google’s DoubleClick infrastructure, making takedown and detection especially challenging.

This campaign is also notable for its exploitation of URL encoding, redirect chains, and legitimate cloud hosting services as disposable infrastructure for phishing content.

The infrastructure observed in these attacks includes subdomains and domains that closely resemble those used by trusted services, further increasing the likelihood of successful social engineering.

Email subjects and pretexts often revolve around 2FA or account security, preying on users’ heightened sensitivity to account compromise notifications.

Organizations using Microsoft 365 are advised to update their email security solutions to account for malformed URLs and encourage users to exercise caution, especially regarding unexpected authentication requests or password reset notifications.

Security teams should augment their detection rules to account for both traditionally formatted and malformed URLs and implement browser-based protections to block access to newly observed malicious domains.

Moreover, users must be educated about the nuances of such phishing attacks, including how legitimate brands format URLs and how to verify the authenticity of 2FA or security notification requests before entering credentials.

The sophistication of Tycoon2FA’s tooling and its ability to exploit minor technical oversights in security infrastructure underscore the continued evolution of credential phishing as a primary vector for cloud account compromise.

Indicators of Compromise (IOCs)

IOC URL	Description
hxxps[://]microsftmailonlinenyukmvdx2t[.]lgotsna[.]es/	Typo-squatted domain targeting M365 users
hxxps[://]googleads[.]g[.]doubleclick[.]net/pcs/click?adurl=%68%74%74%70%73%3A%2F%2F%34[…]%6E%65%74#	Redirect via encoded ad link
hxxps[://]783784387348438743-fkhghccdfzc8e8cd[.]z02[.]azurefd[.]net/	Azure-hosted phishing page
hxxps[://]4839794398349343-g4eydqdkguhcdvgs[.]z02[.]azurefd[.]net	Azure-hosted credential harvesting site
hxxps[://]sdnxk0t5-q[.]alt-bq-4o27qr9a[.]workers[.]dev	Cloudflare Workers disposable phishing
hxxps[://]9kp6wgtaqr[.]cloudflareemail2109399[.]workers[.]dev	Cloudflare Workers disposable phishing

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!