A complex phishing campaign utilizing the Tycoon 2FA Phish-kit has been discovered. This campaign employs Amazon Simple Email Service (SES) and multiple high-profile redirects to steal user credentials. The attack, intricately designed to avoid detection, unfolds in several stages using various compromised domains and services.
Attack Overview
Phishing Emails:
The phishing attack begins with emails sent from Amazon SES, often appearing legitimate due to valid signatures. These emails typically contain two empty PDF attachments and a message from Docusign stating, “You have received a document to review and sign.” Despite occasionally failing SPF and DKIM checks, the emails can seem credible due to the compromised source.
Redirection Chain:
When victims click the “Review Document” link, they are redirected through a series of URLs to hide the final phishing domain. This process includes:
clicktime.symantec.com– Email link rewritten by Symantec Click-time URL Protection.away.vk.com– Redirect via social media.brandequity.economictimes.indiatimes.com– Redirect through a news outlet.jyrepresentacao.com– Custom target-domain masking redirect.t4yzv.vereares.ru– Custom conditional redirect.challenges.cloudflare.com– Cloudflare Turnstile Challenge.
Resources and Services Used
The phishing operation employs multiple content delivery networks and services:
code.jquery.com– jQuery script storage.cdn.socket.io– Socket script storage.github.com– Randexp script storage.dnjs.cloudflare.com– Crypto-js script storage.httpbin.org– External IP lookup service.ipapi.co– IP information service.ok4static.oktacdn.com– Static CDN storage.aadcdn.msauthimages.net– Brand logo storage.
Phishing Engine and Command and Control (C2)
A sophisticated engine and a C2 server manage the phishing campaign’s core activities. The engine’s code is split and obfuscated using XOR and the obfuscator.io service. Communication with the C2 server is encrypted using AES in CBC mode.
Key infrastructure includes:
v4l3n.delayawri.ru– Attackers’ C2 server.keqil.ticemi.com– Core engine of the Tycoon 2FA phish-kit.
Data Transmission Process
The phishing engine communicates with the C2 server in two stages:
- Email Entry: When the victim enters their email, a request is sent to the C2 server with details like email, item, app, and IP information. The server responds with a JSON object containing status, interface elements, UID, and a token.
- Request:
/<email>/<item>/<app>/<ipapi response data> - Response (JSON):
"message":<status>, <interface elements>, "uid":<uid>, "token":<token>
- Password Entry: When the victim enters their password, a request is sent with the token and password. The server responds with a JSON object containing status, interface elements, description, and a token.
- Request:
/<token>/<password> - Response (JSON):
"message":<status>, <interface elements>, "description":<description>, "token":<token>
Compromised Domains
Several third-level domains of Indiatimes.com host a redirector script (/etl.php), facilitating the redirection:
auto.economictimes.indiatimes.comb2bimg.economictimes.indiatimes.comcfo.economictimes.indiatimes.comcio.economictimes.indiatimes.comenergy.economictimes.indiatimes.comrealty.economictimes.indiatimes.comstatic.economictimes.indiatimes.comtelecom.economictimes.indiatimes.comciso.economictimes.indiatimes.combrandequity.economictimes.indiatimes.com
Recommendations
Security experts advise against relying solely on SPF and DKIM checks due to potential email source compromises. Users should be cautious of emails with unexpected attachments and verify links before clicking.
Awareness and Precautions: This phishing campaign underscores the importance of vigilance when receiving emails with suspicious links or attachments. Users should verify the legitimacy of links from unknown sources and avoid entering sensitive information into unverified forms.
Resources: Users can search for suspicious domains or IP addresses using ANY.RUN’s public database, tagged with #phishing, #amazon-ses, and #tycoon. For a detailed analysis and to see the phishing attack in action, users can request a 14-day trial of ANY.RUN Sandbox.
