DOUBLOON DREDGER is a financially motivated threat actor that abuses Notion accounts to invite targets to view PDFs containing malicious links. The links lead to EvilTokens device code harvesting pages. The actor uses JavaScript obfuscation similar to Tycoon 2FA campaigns and is suspected to have access to both EvilTokens and Tycoon 2FA.