Tycoon2FA Campaign Exploits Malformed URLs to Hijack Microsoft 365 Accounts

Tycoon2FA Campaign Exploits Malformed URLs to Hijack Microsoft 365 Accounts

Posted: May 21, 2025
Categories: Security, Phishing
Tags: email threats, credential theft
Author: Npav Lab
Views: 3
A new phishing campaign weaponizes malformed URLs to bypass email filters and steal Microsoft 365 credentials—even bypassing two-factor authentication. Researchers have linked the attack to Tycoon2FA, a notorious Phishing-as-a-Service (PhaaS) operation that enables adversary-in-the-middle (AitM) interception of login sessions. The threat actors behind this campaign are using subtle but dangerous techniques to trick both users and security systems.
Read more