New Phishing-as-a-Service Kit Attempts to Bypass MFA

Researchers observed a widespread Phishing-as-a-Service offering named "Tycoon 2FA" that specializes in AiTM phishing to bypass multi-factor authentication. The service supplies ready-made decoy templates (impersonating DocuSign, Microsoft, Adobe, etc.), uses email links/QR codes and URL redirections to distribute phishing pages, and has been linked to more than 1,100 domains between Oct 2023 and Feb 2024, with a recent version increasing obfuscation and anti-detection measures.