Act Now: Phishing-as-a-Service Attacks are on the Rise

Phishing-as-a-service (PhaaS) platforms generated more than one million phishing attacks in January–February 2025, according to Barracuda. Three platforms—Tycoon 2FA (dominant, ~89% of observed incidents), EvilProxy (~8%), and the new Sneaky 2FA (~3%)—accounted for nearly all activity. Sneaky 2FA specifically targets Microsoft 365, pre-fills spoofed login pages by abusing Microsoft’s "autograb" feature, and can bypass multi-factor authentication using a Telegram-based bot workflow. Barracuda recommends security awareness training, reporting suspicious login pages, performing in-depth log analysis, and checking for MFA anomalies.