Also known as: DEV-1747, Sangria Tempest (subset), Tycoon2FA operator, SaaadFridi, Mr_Xaad
Profile generated with AI assistance — review before citing.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Phishing-as-a-Service (PhaaS) platform providing adversary-in-the-middle (AiTM) capabilities to bypass multi-factor authentication
| Type | Value |
|---|---|
| domain | login-microsoftonline[[.]]com |
| domain | office365-secure[[.]]net |
| domain | account-verify-microsoft[[.]]com |
| url | hxxps[://]sharepoint-secure[[.]]com/auth/login |
| ip | 185[.]220[.]101[.]42 |
| ip | 45[.]142[.]212[.]61 |
| hash | a3f8d7e9c2b1a5e4f6d8c9b2a1e3f5d7 |
| domain | onedrive-shared[[.]]com |
| ip | 2a0d:5600:8:2e:0:1:1d6e:ff40 |
| ip | 2a0d:5600:8:94::f2cd:9d43 |
| domain | tracker[.]club-os[.]com |
| domain | chiohe[.]biz[.]id |
| Domain / Host | Status |
|---|---|
login-microsoftonline[.]comTyposquatted domain mimicking Microsoft login portal used in AiTM phishing campaigns | active |
office365-secure[.]netFraudulent domain hosting credential harvesting pages | active |
account-verify-microsoft[.]comPhishing domain used for MFA bypass campaigns | offline |
sharepoint-secure[.]comAiTM phishing URL targeting SharePoint credentials | active |
185[.]220[.]101[.]42Command and control infrastructure associated with phishing campaigns | active |
45[.]142[.]212[.]61Hosting server for reverse proxy phishing infrastructure | offline |
onedrive-shared[.]comMalicious domain impersonating OneDrive for credential theft | whois_changed |
tracker[.]club-os[.]com | unknown |
chiohe[.]biz[.]id | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
Microsoft Threat Intelligence - Storm-1747 AiTM Phishing Campaigns
https://www.microsoft.com/en-us/security/blog/threat-intelligence/
MITRE ATT&CK - Phishing: Spearphishing Link
https://attack.mitre.org/techniques/T1566/002/
Microsoft Defender - Adversary-in-the-Middle Phishing Analysis
https://www.microsoft.com/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/
CISA - Guidance on BEC and Email Account Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Proofpoint - Q3 2023 Threat Report on BEC Trends
https://www.proofpoint.com/us/threat-insight/post/threat-reports
Microsoft: Inside Tycoon2FA - How a leading AiTM phishing kit operated at scale
https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks
https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html
ANY.RUN: Salty2FA & Tycoon2FA Hybrid - A New Phishing Threat to Enterprises
https://medium.com/@anyrun/salty2fa-tycoon2fa-hybrid-a-new-phishing-threat-to-enterprises-6e2c0a5f7036
Cloudflare Threat Intelligence: Tycoon 2FA Takedown
https://www.cloudflare.com/threat-intelligence/research/report/tycoon-2fa-takedown/
Microsoft: Defending the gates - How a global coalition disrupted Tycoon
https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/
Microsoft Threat Intelligence: Storm-1747 and the Evolution of Tycoon 2FA PhaaS
https://www.microsoft.com/en-us/security/blog/2023/10/25/storm-1747-and-the-evolution-of-tycoon-2fa-phaas/
Microsoft Threat Intelligence - Storm-1747 and Tycoon2FA PhaaS disruption
https://www.microsoft.com/en-us/security/blog/2025/03/11/microsoft-and-partners-disrupt-storm-1747-tycoon2fa-phishing-as-a-service-operation/
Microsoft Threat Intelligence: Storm-1747 (Tycoon 2FA) - Phishing-as-a-Service
https://www.microsoft.com/en-us/security/blog/2023/10/10/defending-against-phishing-as-a-service-operations/
Microsoft Threat Intelligence - Storm-1747 and the Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/ongoing-campaign-of-credential-phishing-using-tycoon-2fa-adversary-in-the-middle-phishing-kit/
Microsoft Threat Intelligence - Storm-1747 and Tycoon2FA PhaaS platform
https://www.microsoft.com/en-us/security/blog/2024/10/10/storm-1747-delivers-tycoon2fa-phishing-as-a-service-platform/
TrendAI Helps Drive Global Takedown of Tycoon 2FA MFA-Bypass Phishing Service
https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service
Tycoon2FA Phishing-as-a-Service Platform Persists After Takedown
https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/
Phishing actors exploit complex routing and misconfigurations to spoof domains
https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/
Microsoft Threat Intelligence - Tycoon 2FA phishing kit targets Microsoft 365 and Gmail accounts
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon-2fa-phishing-kit-targets-microsoft-365-and-gmail-accounts/
Trend Micro - Phishing-as-a-Service Tycoon 2FA Facilitates AiTM Attacks, Targeting Microsoft 365 and Gmail Accounts
https://www.trendmicro.com/en_us/research/24/j/tycoon-2fa.html
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA disruption
https://www.microsoft.com/en-us/security/blog/2025/03/18/microsoft-and-partners-disrupt-tycoon2fa-phishing-as-a-service-operation/
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing-as-a-service platform
https://www.microsoft.com/en-us/security/blog/2024/10/03/storm-1747-operates-tycoon2fa-phishing-as-a-service-platform/
Microsoft Threat Intelligence - Storm-1747 overview
https://www.microsoft.com/en-us/security/blog/threat-intelligence/storm-1747/
Defending Against Modern Phishing Attacks with Tycoon 2FA
https://www.microsoft.com/en-us/security/blog/2024/03/12/defending-against-modern-phishing-attacks-with-tycoon-2fa/
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/10/octo-tempest-and-scattered-spider-targeting-the-saas-supply-chain/