Researchers Uncover Phishing-As-A-Service Domains Associated With Tycoon 2FA

Tycoon 2FA is a Phishing-as-a-Service enabling large-scale two-factor authentication phishing; the report documents an HTML lure that displays a fake voicemail page then redirects to phishing pages, a PHP endpoint (res444.php) returning obfuscated/base64-encoded JavaScript with AES-related values used to build malicious redirects, and shared infrastructure indicators and parameters that can be used to hunt and disrupt related domains.