Notifications
Clear all
Topic starter
27/06/2026 1:48 pm
TL;DR: Tycoon2FA was found active again 20 days after a 330-domain takedown, using S3-hosted lure pages, layered redirects, dual fake CAPTCHA gates, and an unchanged cryptographic fingerprint, according to Abnormal AI. The campaign shows that mature phishing-as-a-service platforms survive infrastructure disruption by preserving identity and obfuscation patterns, not just domains.
NHIMG editorial — based on content published by Abnormal AI: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- Tycoon2FA rebuilt within 20 days of a 330-domain seizure, proving takedowns alone cannot stop mature phishing-as-a-service platforms.
- The payload traps DevTools every 100 milliseconds to detect analysis.
Questions worth separating out
Q: What breaks when phishing-as-a-service platforms are only blocked at the domain level?
A: Domain blocking removes one delivery path, but mature phishing-as-a-service kits rebuild quickly and preserve the same underlying attack logic.
A: Adversary-in-the-middle kits can capture live session tokens as well as passwords, which lets attackers bypass the sign-in moment and reuse authenticated sessions.
Q: How do security teams know if phishing detections are actually keeping pace with rebuilds?
A: Look for detections that still fire when the infrastructure changes.
Practitioner guidance
- Detect the kit, not only the domain. Create detections for stable obfuscation markers such as the LCG constants 9301, 49297, and 233280, plus the bltpg parameter and repeatable decrypt-then-eval behaviour.
- Harden against redirect-layer abuse. Inspect cloud-hosted lure pages, link-management services, and multi-hop click paths as a single chain.
- Assume anti-analysis is part of the threat model. Test detections against fake CAPTCHA flows, debugger traps, and browser automation checks in controlled sandboxes.
What's in the full article
Abnormal AI's full report covers the operational detail this post intentionally leaves for the source:
- The full attack-chain breakdown across all seven stages, including the exact lure and redirect sequence.
- The indicator set for hunters, including domain, IP, and parameter-level clues tied to this campaign.
- The anti-analysis behaviour in more depth, including browser checks, debugger timing, and Linux blanking.
- The mitigation guidance that maps the campaign to practical detection and response steps.
👉 Read Abnormal AI's analysis of the Tycoon2FA rebuild and AiTM tradecraft →
Tycoon2FA’s rebuild shows why takedowns alone do not end AiTM?
Explore further
27/06/2026 3:17 pm
Domain takedowns do not solve identity abuse when the kit identity is stable: Tycoon2FA’s rebuild shows that the meaningful security object is not the domain, but the repeatable delivery and obfuscation pattern behind it. When a platform can recreate itself in under a month, the defensive problem shifts from removal to recognition. Practitioners should treat persistent kit fingerprints as a first-class detection target.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- A second finding in the same research shows that DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys.
A question worth separating out:
Q: What should teams do when a phishing kit uses anti-analysis to block inspection?
A: Treat anti-analysis as a normal capability of mature phishing operations and test your stack accordingly. Sandboxes, proxy inspection, endpoint controls, and browser-based verification should be evaluated against debugger traps, fake CAPTCHA gates, and automation checks so response teams see the real payload before users do.
👉 Read our full editorial: Tycoon2FA rebuilds fast after takedown, exposing phishing resilience
