Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

This feed summarizes multiple Microsoft Security Blog posts describing high‑impact threats and defensive guidance. Key items: disruption of Tycoon2FA, a large AiTM/PhaaS phishing kit reaching hundreds of thousands of organizations (Microsoft DCU + Europol action); signed malware using a stolen EV certificate to deploy legitimate RMM tools and establish persistent backdoors; OAuth redirection abuse used to convert trusted auth flows into phishing/malware delivery; a developer‑targeting campaign that used malicious Next.js repositories to trigger build‑time RCE leading to covert C2; and risks of