SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Physical, insider and cross-cutting attacks

Phishing-as-a-service (PhaaS)

Rented AiTM kits proxy logins to steal credentials and session tokens

categoryPhysical, insider and cross-cutting attacksseverityHighdetectabilityHighlabnot yet measured

Example: Tycoon 2FA, 500k orgs/month

Classification

34 values: 19 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Network attacksSocial engineering
Reach (CVSS)	Social
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	Identity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	Cloud
Target asset class	HumanIdentity
Kill-chain phase (tactic)	CollectionCredential AccessInitial Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile ModificationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess CreationWindows Registry Key Modification

Detection & response

Mitigated by 46

Detected by 27

DET0107 attack-detection-strategy
DET0296 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
2074e137-1b73-4e2d-88ba-5a3407dbdce0 sigma
3569aefd-e535-4391-8c18-24bd01a21eaf sigma
38e7f511-3f74-41d4-836e-f57dfa18eead sigma
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
b07e58cf-cacc-4135-8473-ccb2eba63dd2 sigma
bb0e87ce-c89f-4857-84fa-095e4483e9cb sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
c2c76b77-32be-4d1f-82c9-7e544bdfe0eb sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
d22df9cd-2aee-4089-93c7-9dc4eae77f2c sigma
e0e121d0-be4d-4281-af7e-17abbba4a408 sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4 sigma

Tested by 2

bc177ef9-6a12-4ebc-a2ec-d41e19c2791d atomic
deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic

Attack relationships

Child: ARP spoofing / poisoning
Child: DHCP starvation
Child: Evil twin AP
Child: LLMNR / NBT-NS / mDNS poisoning
Child: NTLM relay / name-resolution poisoning
Child: Rogue DHCP / DHCP spoofing
Child: SMB / NTLM relay
Parent: BEC: data theft (W-2/PII)
Parent: Device-code phishing
Parent: Phishing
Parent: Whaling

Framework references

Primary source: https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
attack: T1566.002 (primary)
attack: T1557

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 708 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1566.002, attack:T1557 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 86 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)