Abnormal Security confirmed
Source: abnormal.ai
Published:
<p>Twenty days after Europol seized 330 Tycoon2FA domains, a new campaign emerged with rebuilt infrastructure and six layers of obfuscation. Here's how it works.</p> <p>A new Tycoon2FA deployment was identified operating from freshly registered Russian infrastructure, 20 days after the March 4, 2026