A highly advanced phishing campaign associated with Tycoon2FA is currently targeting Microsoft 365 users using an unconventional method to manipulate URLs.
This attack takes advantage of malformed URL prefixes that substitute backslashes (https:$$) for the standard forward slashes (https://), allowing it to evade detection by security filters while still being processed by most web browsers.
By exploiting this technique, the attackers create a scenario where email security systems fail to identify the malicious links, but users who click on them are unknowingly directed to pages designed to steal login credentials.
The phishing emails typically appear as notifications related to payment confirmations or account updates. Upon interacting with these emails, victims are redirected through a series of domains, including ones that look like legitimate Microsoft URLs.
To further obscure the malicious intent, the attackers employ sophisticated methods such as URL encoding, making it harder for both automated security tools and human users to detect the threat.
This campaign is linked to the Tycoon2FA operation, a known Phishing-as-a-Service (PhaaS) scheme, which allows cybercriminals to bypass multi-factor authentication through adversary-in-the-middle (AitM) techniques.
Researchers at SpiderLabs have observed key signs of compromise, including the use of Azure Front Door services and Cloudflare Workers to host the phishing infrastructure.
The consequences of these attacks are potentially severe, as compromising Microsoft 365 accounts could grant attackers access to critical organizational data, private communications, and other integrated services.
The Tycoon2FA operation relies on a complex infrastructure designed to exploit authentication processes once login credentials are stolen, enabling attackers to bypass multi-factor authentication (MFA) protections.
The attack showcases remarkable technical ingenuity, particularly in its use of URL manipulation to evade detection. By employing malformed URLs, such as https:\domain.com, the campaign takes advantage of the discrepancies in how web browsers and security tools parse URLs.
One notable example of this is a URL using mixed encoding:
hxxps[://]googleads[.]g[.]doubleclick[.]net/pcs/click?adurl=%68%74%74%70%73%3A%2F%2F%34%38%33…
When decoded, this encoded URL leads to a chain of redirects, ultimately directing victims to phishing sites that closely resemble legitimate Microsoft login pages. These pages are designed to harvest credentials and send them to servers controlled by the attackers.
