Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Microsoft Security Blog highlights multiple high‑impact threats and defensive guidance: Tycoon2FA — a leading AiTM phishing‑as‑a‑service — enabled campaigns reaching over 500,000 organizations monthly and was subject to disruption by Microsoft DCU, Europol, and partners. Separately, signed malware using a stolen EV certificate deployed legitimate RMM tools to establish persistent backdoors, while OAuth redirection abuse and malicious Next.js repositories have been weaponized to deliver phishing, malware, and covert RCE→C2 chains targeting developers and enterprises. The posts also call out the