“By leveraging trusted platforms and domains, malicious actors can bypass traditional security measures, making their phishing emails appear benign and increasing the likelihood of successful attacks,” explained researchers in their investigation report. Darktrace security analysts identified a sophisticated campaign leveraging Tycoon 2FA between late 2024 and early 2025, noting that attackers have specifically evolved their techniques to abuse legitimate services as part of their phishing infrastructure. In successful attacks, perpetrators gained access to sensitive emails, created malicious inbox rules to cover their tracks, and potentially used compromised accounts to launch additional phishing campaigns, creating a dangerous cascading effect that amplifies the initial breach. As MFA adoption increases, security professionals must recognize that while multi-factor authentication remains a crucial security layer, it is no longer an absolute safeguard against sophisticated phishing attacks leveraging AiTM techniques. In documented cases, attackers sent phishing emails from authentic Milanote addresses ([email protected]), referencing “new agreements” and including a mix of legitimate links alongside malicious ones. After initial compromise, attackers typically establish persistence by creating inbox rules with names like “GTH” or “GFH” designed to delete any incoming emails containing strings like “milanote” in the subject or body, effectively hiding their activities from victims. These advanced phishing kits function by positioning themselves between users and legitimate authentication services, creating convincing replicas of Microsoft or Google login pages. When users enter credentials on the phishing page, they’re unwittingly connecting to both the attacker’s infrastructure and the legitimate service, allowing real-time credential and token interception. Adversary-in-the-Middle (AiTM) phishing kits are emerging as sophisticated threats specifically designed to circumvent multi-factor authentication (MFA), once considered an impenetrable defense against account compromises. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 02 May 2025 06:00:20 +0000