Dadsec Hackers Exploit Tycoon2FA Infrastructure to Harvest Office365 Credentials

The cybercriminal group known as Storm-1575 operators of the “Dadsec” Phishing-as-a-Service (PhaaS) platform has been observed leveraging the Tycoon2FA phishing infrastructure to harvest Office365 credentials at scale.

Recent intelligence from Trustwave and corroborating researchers reveals a technical and operational overlap between the Dadsec and Tycoon2FA kits, signaling a convergence of methods and infrastructure that is reshaping the phishing threat landscape.

Infrastructure Reuse

Since September 2023, Trustwave’s Threat Intelligence Team has tracked a surge in large-scale phishing campaigns delivered via email lures.

These typically include enticing recipients with fake shared documents or urgent notifications that link or redirect victims to carefully crafted phishing sites mimicking Microsoft’s Office365 login page.

The campaigns are notable for their use of advanced adversary-in-the-middle (AiTM) techniques, enabling attackers to intercept authentication flows and capture both credentials and session cookies effectively bypassing multi-factor authentication (MFA) protections.

Detailed analysis reveals that domains used in both Dadsec and Tycoon2FA campaigns consistently employ infrastructure traceable to shared Autonomous System Numbers (notably AS19871), with domains typically featuring randomized alphanumeric strings and common top-level domains such as .RU.

These domains host custom PHP scripts such as “res444.php,” “cllascio.php,” and “.000.php” which are integral to payload delivery.

These files not only manage redirection and obfuscation but also execute real-time credential harvesting and exfiltration routines.

Identical templates and code artifacts across newly registered domains further suggest a centralized development and deployment model.

The Tycoon2FA kit, believed to be a direct evolution or clone of Dadsec, demonstrates a high degree of technical sophistication.

Phishing pages are typically served via attack-specific URLs embedded within malicious HTML or PDF email attachments, with user-specific email addresses often pre-populated to bolster social engineering efficacy.

The phishing infrastructure utilizes layered obfuscation, including base64-encoded strings, AES encryption routines, and programmatic JavaScript decoding to cloak C2 (command-and-control) communications and payload delivery.

A notable feature of the Tycoon2FA platform is its integration with Cloudflare Turnstile a verification tool that not only presents CAPTCHA-like challenges to visitors, deterring automated analysis, but also collects telemetry such as IP addresses, user agent strings, and referrer data.

Additionally, custom anti-analysis scripts are loaded post-verification, designed to detect debugging tools, prevent right-click inspection, and disrupt security research efforts.

Modular Phishing

Upon successful navigation of the anti-analysis layers, users are presented with a deceptive login interface that closely mimics Office365, often with the victim’s email already filled.

If the user enters their password, the credentials are captured and AES-encrypted before being transmitted via AJAX POST requests to attacker-controlled C2 endpoints.

The backend infrastructure also aggregates ancillary metadata such as geolocation and browser details to further inform attackers and enhance the precision of future campaigns.

In cases where no email is specified, fallback phishing pages emulate popular services like Microsoft Word Online or media players.

Decoy landing pages, thematically rotated across diverse verticals, are used to add legitimacy and mislead non-targeted visitors or analysts.

The emergence of intertwined PhaaS platforms like Dadsec and Tycoon2FA represents an alarming trend in the phishing ecosystem, where shared infrastructure and evolving evasion techniques empower malicious actors to scale their operations with minimal friction.

The consolidation of credential harvesting, MFA bypass, and automated campaign management into modular kits underscores both the professionalism and accessibility of contemporary phishing services.

Security analysts underscore the critical need for continuous infrastructure monitoring, threat intelligence integration, and adaptive detection mechanisms.

As these platforms proliferate and mature, they pose a significant threat not only to Office365 environments but to any enterprise reliant on cloud-based authentication services.

The current investigation highlights the urgent imperative for organizations to enhance employee awareness, implement robust email filtering, and actively track evolving phishing infrastructure to mitigate the risks posed by these sophisticated, service-based attacks.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.