Also known as: DEV-1747, Sangria Tempest (subset), Tycoon2FA operator, SaaadFridi, Mr_Xaad
Profile generated with AI assistance — review before citing.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Malware used by Storm-1747.
Phishing-as-a-Service (PhaaS) platform providing adversary-in-the-middle (AiTM) capabilities to bypass multi-factor authentication
| Type | Value |
|---|---|
| domain | login-microsoftonline[[.]]com |
| domain | office365-secure[[.]]net |
| domain | account-verify-microsoft[[.]]com |
| url | hxxps[://]sharepoint-secure[[.]]com/auth/login |
| ip | 185[.]220[.]101[.]42 |
| ip | 45[.]142[.]212[.]61 |
| hash | a3f8d7e9c2b1a5e4f6d8c9b2a1e3f5d7 |
| domain | onedrive-shared[[.]]com |
| Domain / Host | Status |
|---|---|
login-microsoftonline[.]comTyposquatted domain mimicking Microsoft login portal used in AiTM phishing campaigns | active |
office365-secure[.]netFraudulent domain hosting credential harvesting pages | active |
account-verify-microsoft[.]comPhishing domain used for MFA bypass campaigns | offline |
sharepoint-secure[.]comAiTM phishing URL targeting SharePoint credentials | active |
185[.]220[.]101[.]42Command and control infrastructure associated with phishing campaigns | active |
45[.]142[.]212[.]61Hosting server for reverse proxy phishing infrastructure | offline |
onedrive-shared[.]comMalicious domain impersonating OneDrive for credential theft | whois_changed |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
Microsoft Threat Intelligence - Storm-1747 AiTM Phishing Campaigns
https://www.microsoft.com/en-us/security/blog/threat-intelligence/
MITRE ATT&CK - Phishing: Spearphishing Link
https://attack.mitre.org/techniques/T1566/002/
Microsoft Defender - Adversary-in-the-Middle Phishing Analysis
https://www.microsoft.com/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/
CISA - Guidance on BEC and Email Account Compromise
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
Proofpoint - Q3 2023 Threat Report on BEC Trends
https://www.proofpoint.com/us/threat-insight/post/threat-reports
Microsoft: Inside Tycoon2FA - How a leading AiTM phishing kit operated at scale
https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks
https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html
ANY.RUN: Salty2FA & Tycoon2FA Hybrid - A New Phishing Threat to Enterprises
https://medium.com/@anyrun/salty2fa-tycoon2fa-hybrid-a-new-phishing-threat-to-enterprises-6e2c0a5f7036
Cloudflare Threat Intelligence: Tycoon 2FA Takedown
https://www.cloudflare.com/threat-intelligence/research/report/tycoon-2fa-takedown/
Microsoft: Defending the gates - How a global coalition disrupted Tycoon
https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/
Microsoft Threat Intelligence: Storm-1747 and the Evolution of Tycoon 2FA PhaaS
https://www.microsoft.com/en-us/security/blog/2023/10/25/storm-1747-and-the-evolution-of-tycoon-2fa-phaas/