Tycoon 2FA Operators Adopt OAuth Device Code Phishing

MITRE Techniques

• [T1566.002] Phishing: Spearphishing Link – The victim clicked a Trustifi click-tracking URL embedded in an email lure (‘the lure was delivered via a Trustifi click-tracking URL embedded in an email themed as a forwarded vendor invoice reminder’).
• [T1090.001] Internal Proxy – The campaign chained legitimate services and redirects through Trustifi and Cloudflare Workers to launder reputation and deliver payloads (‘Trustifi issues an HTTP 307 redirect to a Cloudflare Workers throwaway subdomain’).
• [T1027] Obfuscated Files or Information – The kit used AES wrapping, Base64/XOR wrapping, and string-fragment reconstruction to hide code and content (‘eval’ and ‘atob’ are reconstructed from .slice() calls; ‘CryptoJS AES-CBC encryption layer’).
• [T1497.001] Virtualization/Sandbox Evasion: System Checks – The script checked navigator.webdriver, callPhantom, _phantom, and Burp user-agent strings to detect automated analysis (‘On any positive result, the page is replaced with about:blank’).
• [T1497.003] Virtualization/Sandbox Evasion: Time Based Evasion – A debugger timing trap measured pauses and redirected if execution was delayed (‘If a debugger is attached, the debugger statement pauses execution’).
• [T1610] Deploy Container – Not applicable; no container activity was described in the article.
• [T1583.001] Acquire Infrastructure: Domains – The operators used multiple domains for delivery and backend control, including the Check Domain and C2 endpoints (‘shivacrio[.]com/bytecore~tx1j8’, ‘fijothi[.]com/…’).
• [T1583.004] Acquire Infrastructure: Server – The backend and polling infrastructure were hosted on external cloud infrastructure, including Alibaba Cloud AS45102 (‘Operator polling activity originated from AS45102 (Alibaba Cloud)’).
• [T1557.003] Adversary-in-the-Middle – The campaign did not use a classic AiTM proxy, but it did abuse a legitimate device-login flow to interpose token issuance (‘The phish does not bypass MFA – it changes what MFA is being used to authorize’).
• [T1528] Steal Application Access Token – The operators obtained OAuth access and refresh tokens after victim consent (‘Microsoft issues access and refresh tokens via /organizations/oauth2/v2.0/token to the device that initiated the device-code grant’).