Tycoon 2FA Phishing Kit Targets M365 and Gmail Users

The Tycoon 2FA phishing kit, a Phishing-as-a-Service platform, was designed to bypass two-factor authentication protections for Microsoft 365 and Gmail accounts. It utilizes an Adversary-in-the-Middle approach with a reverse proxy server to create deceptive phishing pages that capture user credentials and session cookies in real-time. This sophisticated tool emerged in August 2023 and continues to pose risks to users of these services.