Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks

SecurityWeek

April 18, 2026 at 10:30 AM

Actively Exploited

Overview

Recent developments show that cybercriminals are adapting to changes in the phishing landscape by reusing Tycoon 2FA tools in various phishing kits. This follows a disruption of the Tycoon 2FA platform, which had been a popular tool among attackers. As a result, there is a noticeable increase in phishing attacks leveraging these tools, putting users at greater risk. The shift indicates that attackers are continuously evolving their methods to bypass security measures. Organizations and individuals need to remain vigilant and update their security protocols to combat this growing threat.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Tycoon 2FA tools, various phishing kits
Action Required: Organizations should enhance their email filtering systems, educate users about phishing tactics, and implement multi-factor authentication where possible.
Timeline: Ongoing since the disruption of Tycoon 2FA

Original Article Summary

Threat actors are reusing Tycoon 2FA tools across other phishing kits following the platform’s disruption. The post Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks appeared first on SecurityWeek.

Impact

Tycoon 2FA tools, various phishing kits

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since the disruption of Tycoon 2FA

Remediation

Organizations should enhance their email filtering systems, educate users about phishing tactics, and implement multi-factor authentication where possible.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Update.

Read Original Article

Related Coverage

Vercel confirms breach as hackers claim to be selling stolen data

BleepingComputer

Vercel, a cloud development platform, has confirmed a security breach after hackers claimed to have accessed its systems and are now trying to sell the stolen data. The company has not disclosed the specific details of the breach, such as how many users or projects may be affected. This incident raises concerns about the security of data hosted on Vercel's platform, which is widely used by developers for building web applications. As the situation develops, users of Vercel should remain vigilant and take precautions to secure their own data. The potential sale of this stolen information could lead to further exploitation or misuse if it falls into the wrong hands.

Apr 19, 2026

Apple account change alerts abused to send phishing emails

BleepingComputer

Apple account change notifications are being exploited by scammers to distribute phishing emails that appear to be legitimate. These emails, sent from Apple's own servers, falsely claim that the recipient's iPhone purchase has been confirmed, tricking users into clicking on malicious links. This tactic increases the likelihood that these emails will bypass spam filters and reach users' inboxes. As a result, unsuspecting Apple users may fall victim to these scams, risking their personal information. It’s essential for users to be cautious and verify any unexpected notifications they receive, even if they seem to come from trusted sources like Apple.

Apr 19, 2026

Cyber attacks fuel surge in cargo theft across logistics industry

Security Affairs

Recent research from Proofpoint reveals that hackers are increasingly targeting logistics firms, aiming to steal cargo and divert payments. These cyberattacks are reportedly connected to organized crime, leading to significant losses in the industry. Attackers employ coordinated remote access campaigns to infiltrate trucking and logistics companies, which raises concerns about the security of supply chains. This trend poses a serious risk not only to the affected companies but also to the broader economy, as disruptions in logistics can impact the availability of goods. Companies in the logistics sector need to enhance their cybersecurity measures to protect against these rising threats.

Apr 19, 2026

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 93

Security Affairs

The Security Affairs Malware newsletter released its latest edition, spotlighting several significant malware incidents. One notable case involves a watering hole attack on users of CPU-Z and HWMonitor, where attackers leverage a compromised website to infect visitors with malware. Another alarming incident is the discovery of a fake 'Claude' site that installs malware, granting attackers remote access to victims' computers. Additionally, the newsletter discusses JanelaRAT, a financial threat specifically targeting users in Latin America. These incidents underline the ongoing risks that users face from malicious software designed to exploit vulnerabilities and compromise personal information.

Apr 19, 2026

ShowDoc Vulnerability Patched in 2020 Now Used in Active Server Takeovers

Hackread – Cybersecurity News, Data Breaches, AI and More

Hackers are currently exploiting a vulnerability in ShowDoc, identified as CVE-2025-0520, which was discovered five years ago. This flaw allows attackers to deploy web shells, enabling remote code execution (RCE) and complete server takeovers on affected systems. The exploitation of this vulnerability is happening globally, impacting various organizations that use ShowDoc. It’s crucial for users and companies to address this issue promptly to prevent unauthorized access and potential data breaches. Security teams should prioritize patching their systems to mitigate the risk posed by this vulnerability.

Apr 18, 2026

Operation PowerOFF: 75K Users of DDoS-for-Hire Services Identified and Warned

Hackread – Cybersecurity News, Data Breaches, AI and More

Operation PowerOFF has successfully identified and issued warnings to around 75,000 users of DDoS-for-hire services. This initiative, led by Europol, resulted in four arrests and the seizure of 53 domains associated with these illegal services. DDoS-for-hire, also known as 'booting', involves paying individuals or groups to launch distributed denial-of-service attacks against targeted websites or networks, causing disruption. The crackdown not only targets the providers but also the users who engage in these activities, highlighting the ongoing efforts to combat cybercrime. Users involved in these services face potential legal consequences, which raises awareness about the risks of participating in such illicit activities.

Apr 18, 2026