Phishing-as-a-Service

The China-nexus threat actor UAT-7810 is expanding its Operational Relay Box (ORB) networks by exploiting known vulnerabilities in unpatched Ruckus and ASUS routers to deploy custom backdoors like LONGLEASH and DOGLEASH, while other threats include the ARToken Phishing-as-a-Service platform targeting Microsoft 365, critical flaws in AirDrop/Quick Share, and a backdoor in Tenda router firmware.

The Tycoon2FA PhaaS platform, which facilitates MFA bypass and email account compromise, experienced a temporary decrease in activity following a takedown in March 2026, but campaign volumes and TTPs quickly returned to pre-disruption levels, indicating the actors behind the platform remain active and adaptive.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass MFA and compromise email accounts, has demonstrated resilience following a law enforcement takedown, with campaign activity returning to pre-disruption levels and TTPs remaining consistent.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, which enables cybercriminals to bypass multi-factor authentication (MFA) to compromise email accounts, has resumed campaign activity to pre-disruption levels after a law enforcement takedown.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass multifactor authentication (MFA), has resurged to pre-takedown levels of activity following a disruption effort in March 2026, maintaining its original tactics, techniques, and procedures (TTPs) for credential harvesting and cloud compromise.