INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Phishing platforms and infostealers linked to identity attacks surge

| 2025-07-07 12:00 CRITICAL HIGH DATA BREACH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
A 156 percent jump in cyberattacks targeting user logins has been reported since last year, with identity-based attacks now making up 59 percent of all investigations carried out by security experts. The rise is attributed to advanced phishing kits and info-stealing malware, particularly phishing-as-a-service platforms such as Tycoon 2FA that offer convincing pre-made phishing pages for major workplace platforms at a relatively low cost of $200-300 per month. These services have emerged as the dominant phishing tool since its release in 2023, with over 2,000 monthly subscribers, and are capable of stealing session cookies and bypassing MFA. The attacks often lead to business email compromise (BEC) schemes and ransomware disasters, which can result in significant financial losses for organizations, estimated to be deep into the 10-digit range.
Technical Mitigations AI-generated
• User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider
Target & Sectors
Global Scope financefinance
Incident Timeline
‎2025/07/07
Phishing-as-a-service platforms such as Tycoon 2FA are democratizing identity attacks thanks to their sophisticated capabilities and relatively low cost.
threat_actor Scattered Spider
Figures from last year showed that BEC attacks, cases involving the impersonation of support staff a la Scattered Spider, and even investment fraud, all contributed to greater financial losses, deep into the 10-digit range.
infrastructure Microsoft 365
…-300 per month, these kinds of toolkits offer convincing pre-made phishing pages for the major workplace platforms, such as Microsoft 365 and Google Workspace, as well as adversary-in-the-middle (AitM) functions to steal session cookies and bypass…
financial 300 $ outlay
And for those who can't afford the $200-300 outlay for Tycoon 2FA, that's where infostealers come into play.
financial $10 Entities
As little as $10 can unlock access to various logs gathered by info-grabbing malware, offering a more hands-off approach to email compromise.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
…-300 per month, these kinds of toolkits offer convincing pre-made phishing pages for the major workplace platforms, such as Microsoft 365 and Google Workspace, as well as adversary-in-the-middle (AitM) functions to steal session cookies and bypass…
Metrics
financial
300
$ Outlay
And for those who can't afford the $200-300 outlay for Tycoon 2FA, that's where infostealers come into play.
Metrics
financial
10
Financial Impact
As little as $10 can unlock access to various logs gathered by info-grabbing malware, offering a more hands-off approach to email compromise.
Intelligence Sources
The Register - CSO 2025-07-07