Also known as: DEV-1747, Sangria Tempest (subset), Tycoon2FA operator, SaaadFridi, Mr_Xaad
Profile generated with AI assistance — review before citing.
T1056.003
T1539
T1078.004
T1110.001
T1185
T1114.002
T1589.002
T1598.003
T1586.002
T1111
T1528
T1606.002
T1087.004
T1204.002
T1556.002
T1557.001
T1557.002
T1583.001
T1583.008
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Phishing-as-a-Service (PhaaS) platform providing adversary-in-the-middle (AiTM) capabilities to bypass multi-factor authentication
| Type | Value |
|---|---|
| domain | login-microsoftonline[[.]]com |
| domain | office365-secure[[.]]net |
| domain | account-verify-microsoft[[.]]com |
| url | hxxps[://]sharepoint-secure[[.]]com/auth/login |
| ip | 185[.]220[.]101[.]42 |
| ip | 45[.]142[.]212[.]61 |
| hash | a3f8d7e9c2b1a5e4f6d8c9b2a1e3f5d7 |
| domain | onedrive-shared[[.]]com |
| ip | 2a0d:5600:8:2e:0:1:1d6e:ff40 |
| ip | 2a0d:5600:8:94::f2cd:9d43 |
| domain | tracker[.]club-os[.]com |
| domain | chiohe[.]biz[.]id |
| Domain / Host | Status |
|---|---|
login-microsoftonline[.]comTyposquatted domain mimicking Microsoft login portal used in AiTM phishing campaigns | active |
office365-secure[.]netFraudulent domain hosting credential harvesting pages | active |
account-verify-microsoft[.]comPhishing domain used for MFA bypass campaigns | offline |
sharepoint-secure[.]comAiTM phishing URL targeting SharePoint credentials | active |
185[.]220[.]101[.]42Command and control infrastructure associated with phishing campaigns | active |
45[.]142[.]212[.]61Hosting server for reverse proxy phishing infrastructure | offline |
onedrive-shared[.]comMalicious domain impersonating OneDrive for credential theft | whois_changed |
tracker[.]club-os[.]com | unknown |
chiohe[.]biz[.]id | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
Microsoft Threat Intelligence - Storm-1747 AiTM Phishing Campaigns
https://www.microsoft.com/en-us/security/blog/threat-intelligence/
MITRE ATT&CK - Phishing: Spearphishing Link
https://attack.mitre.org/techniques/T1566/002/
Microsoft Defender - Adversary-in-the-Middle Phishing Analysis
https://www.microsoft.com/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/
CISA - Guidance on BEC and Email Account Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Proofpoint - Q3 2023 Threat Report on BEC Trends
https://www.proofpoint.com/us/threat-insight/post/threat-reports
Microsoft: Inside Tycoon2FA - How a leading AiTM phishing kit operated at scale
https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks
https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html
ANY.RUN: Salty2FA & Tycoon2FA Hybrid - A New Phishing Threat to Enterprises
https://medium.com/@anyrun/salty2fa-tycoon2fa-hybrid-a-new-phishing-threat-to-enterprises-6e2c0a5f7036
Cloudflare Threat Intelligence: Tycoon 2FA Takedown
https://www.cloudflare.com/threat-intelligence/research/report/tycoon-2fa-takedown/
Microsoft: Defending the gates - How a global coalition disrupted Tycoon
https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/
Microsoft Threat Intelligence: Storm-1747 and the Evolution of Tycoon 2FA PhaaS
https://www.microsoft.com/en-us/security/blog/2023/10/25/storm-1747-and-the-evolution-of-tycoon-2fa-phaas/
Microsoft Threat Intelligence - Storm-1747 and Tycoon2FA PhaaS disruption
https://www.microsoft.com/en-us/security/blog/2025/03/11/microsoft-and-partners-disrupt-storm-1747-tycoon2fa-phishing-as-a-service-operation/
Microsoft Threat Intelligence: Storm-1747 (Tycoon 2FA) - Phishing-as-a-Service
https://www.microsoft.com/en-us/security/blog/2023/10/10/defending-against-phishing-as-a-service-operations/
Microsoft Threat Intelligence - Storm-1747 and the Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/ongoing-campaign-of-credential-phishing-using-tycoon-2fa-adversary-in-the-middle-phishing-kit/
Microsoft Threat Intelligence - Storm-1747 and Tycoon2FA PhaaS platform
https://www.microsoft.com/en-us/security/blog/2024/10/10/storm-1747-delivers-tycoon2fa-phishing-as-a-service-platform/
TrendAI Helps Drive Global Takedown of Tycoon 2FA MFA-Bypass Phishing Service
https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service
Tycoon2FA Phishing-as-a-Service Platform Persists After Takedown
https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/
Phishing actors exploit complex routing and misconfigurations to spoof domains
https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/
Microsoft Threat Intelligence - Tycoon 2FA phishing kit targets Microsoft 365 and Gmail accounts
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon-2fa-phishing-kit-targets-microsoft-365-and-gmail-accounts/
Trend Micro - Phishing-as-a-Service Tycoon 2FA Facilitates AiTM Attacks, Targeting Microsoft 365 and Gmail Accounts
https://www.trendmicro.com/en_us/research/24/j/tycoon-2fa.html
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA disruption
https://www.microsoft.com/en-us/security/blog/2025/03/18/microsoft-and-partners-disrupt-tycoon2fa-phishing-as-a-service-operation/
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing-as-a-service platform
https://www.microsoft.com/en-us/security/blog/2024/10/03/storm-1747-operates-tycoon2fa-phishing-as-a-service-platform/
Microsoft Threat Intelligence - Storm-1747 overview
https://www.microsoft.com/en-us/security/blog/threat-intelligence/storm-1747/
Defending Against Modern Phishing Attacks with Tycoon 2FA
https://www.microsoft.com/en-us/security/blog/2024/03/12/defending-against-modern-phishing-attacks-with-tycoon-2fa/
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/10/octo-tempest-and-scattered-spider-targeting-the-saas-supply-chain/
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA PhaaS Analysis
https://www.microsoft.com/en-us/security/blog/2024/10/03/how-storm-1747-uses-tycoon2fa-phishing-kit-to-target-sso-and-cloud-service-credentials/
Microsoft Digital Defense Report 2024 - Tycoon2FA Phishing Kit
https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2024
Trend Micro - Tycoon2FA PhaaS Platform Analysis
https://www.trendmicro.com/en_us/research/24/a/threat-actor-group-uses-tycoon-2fa-phishing-kit.html
Microsoft Threat Intelligence - Storm-1747 and Tycoon2FA PhaaS Platform
https://www.microsoft.com/en-us/security/blog/2024/09/12/tycoon-2fa-phishing-kit-targets-microsoft-365-and-gmail/
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA PhaaS Platform
https://www.microsoft.com/en-us/security/blog/2024/03/12/tycoon-2fa-phishing-kit-leverages-aitm-attacks/
Microsoft Threat Intelligence - Storm-1747 and the Tycoon2FA PhaaS Platform
https://www.microsoft.com/en-us/security/blog/2024/10/17/storm-1747-and-the-tycoon2fa-phishing-as-a-service-platform/
Trend Micro - Unmasking Tycoon2FA: Linking Cyber Personas to the Real World
https://www.trendmicro.com/en_us/research/24/k/unmasking-tycoon2fa.html
Microsoft Threat Intelligence - Storm-1747 operations and Tycoon2FA PhaaS platform
https://www.microsoft.com/en-us/security/blog/2024/03/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/
Cloudflare: Tycoon 2FA – a phishing kit targeting Microsoft 365 and Gmail
https://blog.cloudflare.com/2024-phishing-report/
Microsoft Threat Intelligence: Storm-1747 and the rise of Tycoon2FA
https://www.microsoft.com/en-us/security/blog/2024/01/17/storm-1747-and-the-rise-of-tycoon2fa/
Microsoft Threat Intelligence - Storm-1747 operating Tycoon 2FA phishing-as-a-service at scale
https://www.microsoft.com/en-us/security/blog/2024/10/10/storm-1747-using-tycoon-2fa-phishing-as-a-service-at-scale/
Microsoft Threat Intelligence: Storm-1747 and the rise of Tycoon2FA
https://www.microsoft.com/en-us/security/blog/2024/03/12/tycoon-2fa-phishing-kit-new-variant-targets-microsoft-365-and-gmail-accounts/
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA disruption
https://www.microsoft.com/en-us/security/blog/2025/03/13/interpol-and-partners-disrupt-storm-1747-tycoon2fa-phishing-as-a-service-operation/
Interpol Operation Synergia announcement
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-operation-targets-phishing-as-a-service-platforms
Microsoft Threat Intelligence - Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon-2fa-phishing-kit-used-in-aitm-attacks-targeting-more-than-100-organizations/
Interpol Operation Synergia II disrupts global cybercrime
https://www.interpol.int/News-and-Events/News/2025/Global-police-operation-targets-cybercriminals-behind-phishing-malware-and-ransomware-attacks
Microsoft Threat Intelligence - Tycoon2FA PhaaS platform disrupted
https://www.microsoft.com/en-us/security/blog/2025/03/20/tycoon2fa-phaas-platform-disrupted/
Interpol Operation Synergia dismantles phishing infrastructure
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-dismantles-phishing-infrastructure
Microsoft Digital Defense Report 2024 - Tycoon 2FA PhaaS operation
https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024
Microsoft Security Blog - Interpol operation disrupts major phishing-as-a-service platform
https://www.microsoft.com/en-us/security/blog/2025/03/11/interpol-operation-disrupts-major-phishing-as-a-service-platform/
Microsoft Threat Intelligence - Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon-2fa-phishing-kit-and-its-ever-evolving-tactics/
Interpol Operation Synergia dismantles phishing infrastructure
https://www.interpol.int/en/News-and-Events/News/2025/Operation-Synergia-dismantles-phishing-infrastructure-targeting-millions
Microsoft Threat Intelligence: Tycoon2FA phishing kit service
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon2fa-phishing-kit-service-emerging-phishing-as-a-service-threat/
Interpol Operation Synergia II disrupts phishing operations
https://www.interpol.int/en/News-and-Events/News/2025/Operation-Synergia-II-330-domains-seized-in-global-crackdown-on-online-threats
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/08/microsoft-tackles-tycoon2fa-phishing-as-a-service-platform/
Interpol Operation Synergia II targets cybercrime including phishing platforms
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-II-global-crackdown-on-cybercrime
Microsoft Security Threat Intelligence - Storm-1747 Tycoon2FA PhaaS Platform Disrupted
https://www.microsoft.com/en-us/security/blog/2025/03/13/tycoon2fa-phishing-as-a-service-platform-disrupted-in-global-law-enforcement-operation/
Interpol Operation Synergia Targets Global Phishing Operations
https://www.interpol.int/News-and-Events/News/2025/Global-cybercrime-crackdown-targets-phishing-as-a-service-platforms
Microsoft Threat Intelligence - Storm-1747 disruption
https://www.microsoft.com/en-us/security/blog/2025/03/13/operation-synergia-law-enforcement-and-microsoft-disrupt-tycoon2fa-phishing-as-a-service-platform/
Trend Micro - Tycoon2FA Attribution
https://www.trendmicro.com/en_us/research/25/c/tycoon2fa-phishing-as-a-service-platform.html
Microsoft Threat Intelligence - Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/29/tycoon-2fa-phishing-kit-adds-mfa-bypass-for-microsoft-365-and-gmail/
Interpol Operation Synergia II - Phishing-as-a-Service disruption
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-operation-Synergia-II-cracks-down-on-cybercrime
Interpol Operation Synergia - Phishing Infrastructure Disruption
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-global-action-targets-phishing-and-online-fraud
Microsoft Threat Intelligence - Storm-1747 and the Tycoon2FA PhaaS platform
https://www.microsoft.com/en-us/security/blog/2024/12/11/storm-1747-and-the-tycoon2fa-phaas-platform/
Interpol Operation Synergia II disrupts cybercrime infrastructure
https://www.interpol.int/en/News-and-Events/News/2025/Operation-Synergia-II-disrupts-cybercrime-infrastructure
Microsoft Threat Intelligence: Tycoon 2FA phishing kit used in attacks against more than 2,500 Microsoft 365 accounts
https://www.microsoft.com/en-us/security/blog/2024/10/08/tycoon-2fa-phishing-kit-used-in-attacks-against-more-than-2500-microsoft-365-accounts/
Trend Micro: Unmasking Tycoon 2FA: A Comprehensive Investigation into the Developer and the Operation
https://www.trendmicro.com/en_us/research/25/c/unmasking-tycoon-2fa.html
Microsoft Threat Intelligence - Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon2fa-phishing-kit-becoming-popular-among-cybercriminals/
INTERPOL Operation Synergia II targets phishing infrastructure
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-led-operation-targets-phishing-infrastructure
Microsoft Security Blog: Tycoon2FA phishing kit enables AiTM attacks at scale
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon2fa-phishing-kit-enables-aitm-attacks-at-scale/
Trend Micro: Tycoon2FA Phishing Kit and Its Operators
https://www.trendmicro.com/en_us/research/25/a/tycoon2fa-phishing-kit-and-its-operators.html
Microsoft Threat Intelligence: Storm-1747 and the Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/08/storm-1747-and-tycoon2fa-phishing-kit/
Interpol Operation Synergia II disrupts global cybercrime
https://www.interpol.int/en/News-and-Events/News/2025/Operation-Synergia-II-strikes-at-cybercrime
Microsoft Threat Intelligence - Storm-1747 operates Tycoon2FA phishing platform
https://www.microsoft.com/en-us/security/blog/2024/10/28/tycoon-2fa-a-phishing-kit-targeting-microsoft-365-and-gmail/
Interpol Operation Synergia targets phishing-as-a-service platform
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-Interpol-and-private-sector-dismantle-major-phishing-as-a-service-platform
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA PhaaS disruption
https://www.microsoft.com/en-us/security/blog/2025/03/12/storm-1747-tycoon2fa-phaas-disruption/
Interpol Operation Synergia phishing disruption
https://www.interpol.int/News-and-Events/News/2025/Global-operation-targets-phishing-as-a-service-platform
Microsoft Threat Intelligence - Tycoon 2FA phishing kit goes offline after enforcement action
https://www.microsoft.com/en-us/security/blog/2025/03/06/tycoon-2fa-phishing-kit-goes-offline-after-enforcement-action/
Interpol Operation Synergia II
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-operation-Synergia-II-targets-phishing-fraud-and-ransomware
Microsoft Threat Intelligence: Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/10/tycoon-2fa-phishing-kit-observed-in-the-wild/
Interpol Operation Synergia dismantles global phishing infrastructure
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-dismantles-global-phishing-infrastructure
Microsoft Threat Intelligence - Tycoon 2FA phishing kit targets Microsoft 365 and Gmail accounts
https://www.microsoft.com/en-us/security/blog/2024/10/08/tycoon-2fa-phishing-kit-targets-microsoft-365-and-gmail-accounts/
Trend Micro - Tycoon 2FA: Diving into the Infamous Phishing Kit
https://www.trendmicro.com/en_us/research/24/k/tycoon-2fa-diving-into-the-infamous-phishing-kit.html
Microsoft Threat Intelligence: Storm-1747 and the evolution of Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/storm-1747-and-the-evolution-of-tycoon2fa-phishing-kit/
Interpol Operation Synergia II disrupts global cybercrime
https://www.interpol.int/en/News-and-Events/News/2025/Operation-Synergia-II-disrupts-global-cybercrime
Microsoft Threat Intelligence - Storm-1747 and the Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/08/storm-1747-and-the-tycoon2fa-phishing-kit/
Interpol Operation Synergia II targets phishing platforms
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-operation-targets-phishing-platforms
Microsoft Threat Intelligence - Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/07/tycoon-2fa-phishing-kit-used-in-extensive-campaigns-targeting-microsoft-365-and-gmail-accounts/
Interpol Operation Synergia on cybercrime infrastructure
https://www.interpol.int/News-and-Events/News/2025/Operation-Synergia-major-cybercrime-infrastructure-targeted
Microsoft Threat Intelligence - Tycoon2FA PhaaS platform disrupted
https://www.microsoft.com/en-us/security/blog/2025/03/11/tycoon2fa-phaas-platform-disrupted/
Trend Micro - Unmasking Tycoon 2FA: The Invisible Phishing Threat
https://www.trendmicro.com/en_us/research/25/a/unmasking-tycoon-2fa.html
Microsoft Security Threat Intelligence: Storm-1747 and the Tycoon2FA PhaaS platform
https://www.microsoft.com/en-us/security/blog/2024/10/10/storm-1747-and-the-tycoon2fa-phaas-platform/
Interpol Operation Synergia: Global police action targets phishing platforms
https://www.interpol.int/en/News-and-Events/News/2025/Global-police-action-targets-phishing-platforms
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA PhaaS disruption
https://www.microsoft.com/en-us/security/blog/2025/03/13/microsoft-partners-with-interpol-to-disrupt-storm-1747-tycoon2fa-phishing-as-a-service-operation/
Interpol Operation Synergia III announcement
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-led-operation-takes-down-major-phishing-as-a-service-platform
Microsoft Threat Intelligence - Tycoon 2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/08/tycoon-2fa-phishing-kit-becoming-popular-among-cybercriminals/
Interpol Operation Synergia II targets phishing infrastructure
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-private-sector-join-forces-to-take-down-cybercrime-infrastructure
Microsoft Threat Intelligence - Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon2fa-phishing-kit-targets-microsoft-365-and-gmail-accounts/
Interpol Operation Synergia II - Tycoon2FA Disruption
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-targets-phishing-schemes-in-global-operation
Microsoft Threat Intelligence - Storm-1747 deploys large-scale phishing-as-a-service operation
https://www.microsoft.com/en-us/security/blog/2024/10/03/storm-1747-deploys-large-scale-phishing-as-a-service-operation/
Interpol Operation Synergia disrupts global phishing networks
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-disrupts-global-phishing-networks-in-Operation-Synergia
Microsoft: Storm-1747 and Tycoon 2FA PhaaS Platform Disrupted
https://www.microsoft.com/en-us/security/blog/2025/03/11/storm-1747-and-tycoon-2fa-phaas-platform-disrupted/
Interpol Operation Synergia Announcement
https://www.interpol.int/News-and-Events/News/2025/INTERPOL-led-operation-takes-down-major-phishing-platform
Microsoft Threat Intelligence: Tycoon2FA phishing kit
https://www.microsoft.com/en-us/security/blog/2024/10/03/tycoon2fa-phishing-kit-leveraged-in-large-scale-credential-theft-campaigns/
Interpol Operation Synergia - Phase II Results
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-operation-shuts-down-22-000-malicious-IP-addresses
Microsoft Threat Intelligence - Tycoon2FA phishing kit seized in international law enforcement operation
https://www.microsoft.com/en-us/security/blog/2025/03/20/tycoon2fa-phishing-kit-seized-in-international-law-enforcement-operation/
Interpol Operation Synergia II
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-operation-targets-global-cybercrime-infrastructure
Microsoft Threat Intelligence - Storm-1747 Tycoon2FA PhaaS disruption
https://www.microsoft.com/en-us/security/blog/2025/03/18/interpol-and-partners-disrupt-tycoon2fa-phishing-as-a-service-platform/
Trend Micro - Tycoon2FA Developer Identity Analysis
https://www.trendmicro.com/en_us/research/25/a/tycoon2fa-phishing-kit.html
INTERPOL announces takedown of Tycoon2FA phishing-as-a-service platform
https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-announces-takedown-of-Tycoon2FA-phishing-as-a-service-platform