April 29, 2025

MFA Under Attack: AiTM Phishing Kits Abusing Legitimate Services

Tycoon 2FA uses AiTM phishing and legitimate services to bypass MFA. Darktrace AI stopped it, read the blog to learn how Self-Learning AI detects sophisticated threats.

Written by

Alexandra Sentenac

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Alexandra Sentenac

Cyber Analyst

Apr 2025

In late 2024 and early 2025, the Darktrace Security Operations Center (SOC) investigated alerts regarding separate cases of Software-as-a-Service (SaaS) account compromises on two customer environments that presented several similarities, suggesting they were part of a wider phishing campaign.

This campaign was found to leverage the project collaboration and note-taking application, Milanote, and the Tycoon 2FA phishing kit.

Legitimate services abused

As highlighted in Darktrace's 2024 Annual Threat Report [1], threat actors are abusing legitimate services, like Milanote, in their phishing campaigns. By leveraging these trusted platforms and domains, malicious actors can bypass traditional security measures, making their phishing emails appear benign and increasing the likelihood of successful attacks.

Darktrace categorizes these senders and platforms as free content senders. These services allow users to send emails containing custom content (e.g., files) from fully validated, fixed service address belonging to legitimate corporations. Although some of these services permit full body and subject customization by attackers, the structure of these emails is generally consistent, making it challenging to differentiate between legitimate and malicious emails.

What is Tycoon 2FA?

Tycoon 2FA is an Adversary-in-the-Middle (AitM) phishing kit, first seen in August 2023 and distributed via the Phishing-as-a-Service (PhaaS) model [2]. It targets multi-factor authentication (MFA) by intercepting credentials and MFA tokens during authentication on fake Microsoft or Google login pages. The attacker captures session cookies after MFA is completed, allowing them to replay the session and access the user account, even if credentials are reset. The rise in MFA use has increased the popularity of AitM phishing kits like Tycoon 2FA and Mamba 2FA, another AiTM phishing kit investigated by Darktrace.

Initial access via phishing email

At the beginning of 2025, Darktrace observed phishing emails leveraging Milanote being sent to multiple internal recipients in an organization. In this attack, the same email was sent to 19 different users, all of which were held by Darktrace.

The subject line of the emails mentioned both a legitimate internal user of the company, the company name, as well as a Milanote board regarding a “new agreement” in German. It is a common social engineering technique to mention urgent matters, such as unpaid invoices, expired passwords, or awaiting voicemails, in the subject line to prompt immediate action from the user. However, this tactic is now widely covered in phishing awareness training, making users more suspicious of such emails. In this case, while the subject mentioned a “new agreement,” likely raising the recipient’s curiosity, the tone remained professional and not overly alarming. Additionally, the mention of a colleague and the standardized language typical of free content sender emails further helped dispel concerns regarding the email.

These emails were sent by the legitimate address support@milanote[.]com and referenced "Milanote" in the personal field of the header but originated from the freemail address “ahnermatternk.ef.od.13@gmail[.]com”. Darktrace / EMAIL recognized that none of the recipients had previously received a file share email from Milanote, making this sender unfamiliar in the customer's email environment

The emails contained several benign links to legitimate Milanote endpoints (including an unsubscribe link) which were not flagged by Darktrace. However, they also included a malicious link designed to direct recipients to a pre-filled credential harvesting page hosted on Milanote, prompting them to register for an account. Despite not blocking the legitimate Milanote links in the same email, Darktrace locked the malicious link, preventing users from visiting the credential harvester.

Figure 1: Credential harvesting page sent to recipients, as seen in. sandbox environment.

Around one minute later, one recipient received a legitimate email from Milanote confirming their successful account registration, indicating they had accessed the phishing page. This email had a lower anomaly score and was not flagged by Darktrace / EMAIL because, unlike the first email, it did not contain any suspicious links and was a genuine account registration notification. Similarly, in the malicious Milanote email, only the link leading to the phishing page was blocked, while the benign and legitimate Milanote links remained accessible, demonstrating Darktrace’s precise and targeted actioning.

Figure 2: A legitimate and a malicious Milanote email received by one recipient.

Around the same time, Darktrace / NETWORK observed the same user’s device making DNS query for the domain name “lrn.ialeahed[.]com” , which has been flagged as a Tycoon 2FA domain [2], suggesting the use of this phishing platform.

Once the user had entered their details in the credential harvester, it is likely that they were presented a document hosted on Milanote that contained the final payload link – likely hidden behind text instructing users to access a “new agreement” document.

External research indicates that the user was likely directed to a Cloudflare Turnstile challenge meant to reroute unwanted traffic, such as automated security scripts and penetration testing tools [2] [3]. After these checks and other background processes are completed, the user is directed to the final landing page. In this case, it was likely a fake login prompt hosted on the attacker’s server, where the user is asked to authenticate to their account using MFA. By burrowing malicious links and files in this manner, threat actors can evade analysis by traditional security email gateways, effectively bypassing their protection.

Darktrace’s analysis of the structure and word content of the phishing emails resulted in an 82% probability score that the email was malicious, and the email further received a 67% phishing inducement score, representing how closely the structure and word content of the emails compared to typical phishing emails.

All these unusual elements triggered multiple alerts in Darktrace / EMAIL, focusing on two main suspicious aspects: a new, unknown sender with no prior correspondence with the recipients or the environment, and the inclusion of a link to a previously unseen file storage solution.

Figure 3: Milanote phishing email as seen within Darktrace / EMAIL.

After detecting the fifth email, the “Sender Surge” model alert was triggered in Darktrace / EMAIL due to a significant number of recipients being emailed by this new suspicious sender in a short period. These recipients were from various departments across the customer’s organization, including sales, marketing, purchasing, and production. Darktrace / EMAIL determined that the emails were sent to a highly unusual group of internal recipients, further raising doubts about the business legitimacy.

Darktrace / EMAIL suggested actions to contain the attack by holding all Milanote phishing emails back from recipient’s inboxes, except for the detailed email with locked links. However, autonomous actions were not enabled at the time, allowing the initial email to reach recipients' inboxes, providing a brief window for interaction. Unfortunately, during this window, one recipient clicked on the Milanote payload link, leading to the compromise of their account.

SaaS account takeover

About three minutes after the malicious Milanote email was received, Darktrace / IDENTITY detected an unusual login to the email recipient’s SaaS account. The SaaS actor was observed accessing files from their usual location in Germany, while simultaneously, a 100% rare login occurred from a location in the US that had never been seen in the customer’s environment before. This login was also flagged as suspicious by Microsoft 365, triggering a 'Conditional Access Policy' that required MFA authentication, which was successfully completed.

Figure 4: Tycoon 2FA adnimistration panel login page dated from October 2023 [3].

Despite the successful authentication, Darktrace / IDENTITY recognized that the login from this unusual location, coupled with simultaneous activity in another geographically distant location, were highly suspicious. Darktrace went on to observe MFA-validated logins from three separate US-based IP addresses: 89.185.80[.]19, 5.181.3[.]68, and 38.242.7[.]252. Most of the malicious activity was performed from the latter, which is associated with the Hide My Ass (HMA) VPN network [5].

Figure 5: Darktrace’s detection of the suspicious login from the US while the legitimate user was logged in from Germany.

Figure 6: Darktrace’s detection of the suspicious login following successful MFA authentication.

Following this, the malicious actor accessed the user’s inbox and created a new mailbox rule named “GTH” that deleted any incoming email containing the string “milanote” in the subject line or body. Rules like this are a common technique used by attackers to leverage compromised accounts for launching phishing campaigns and concealing replies to phishing emails that might raise suspicions among legitimate account holders. Using legitimate, albeit compromised, accounts to send additional phishing emails enhances the apparent legitimacy of the malicious emails. This tactic has been reported as being used by Tycoon 2FA attackers [4].

The attacker accessed over 140 emails within the legitimate user’s inbox, including both the inbox and the “Sent Items” folder. Notably, the attacker accessed five emails in the “Sent Items” folder and modified their attachments. These emails were mainly related to invoices, suggesting the threat actor may have been looking to hijack those email threads to send fake invoices or replicate previous invoice emails.

Darktrace’s Cyber AI Analyst^TM launched autonomous investigations into the individual events surrounding this suspicious activity. It connected these separate events into a single, broad account takeover incident, providing the customer with a clearer view of the ongoing compromise.

Figure 7: Cyber AI Analyst’s detection of unusual SaaS account activities in a single incident.

Figure 8: Cyber AI Analyst investigation of suspicious activities performed by the attacker.

Darktrace's response

Within three minutes of the first unusual login alert, Darktrace’s Autonomous Response intervened, disabling the compromised user account for two hours.

As the impacted customer was subscribed to the Managed Threat Detection Service, Darktrace’s SOC team investigated the activity further and promptly alerted the customer’s security team. With the user’s account still disabled by Autonomous Response, the attack was contained, allowing the customer’s security team valuable time to investigate and remediate. Within ten minutes of receiving the alert from Darktrace’s SOC, they reset the user’s password, closed all active SaaS sessions, and deleted the malicious email rule. Darktrace’s SOC further supported the customer through the Security Operations Service Support service by providing information about the data accessed and identifying any other affected users.

Figure 9: Autonomous Response actions carried out by Darktrace / IDENTITY to contain the malicious activity.

A wider Milanote phishing campaign?

Around a month before this compromise activity, Darktrace alerted another customer to similar activities involving two compromised user accounts. These accounts created new inbox rules named “GFH” and “GVB” to delete all incoming emails containing the string “milanote” in their subject line and/or body.

The phishing emails that led to the compromise of these user accounts were similar to the ones discussed above. Specifically, these emails were sent via the Milanote platform and referenced a “new agreement” (in Spanish) being shared by a colleague. Additionally, the payload link included in the phishing emails showed the same UserPrincipalName (UPN) attribute (i.e., click?upn=u001.qLX9yCzR), which has been seen in other Milanote phishing emails leveraging Tycoon 2FA reported by OSINT sources [6]. Interestingly, in some cases, the email also referenced a “new agreement” in Portuguese, indicating a global campaign.

Based on the similarities in the rule’s naming convention and action, as well as the similarities in the phishing email subjects, it is likely that these were part of the same campaign leveraging Milanote and Tycoon 2FA to compromise user accounts. Since its introduction, the Tycoon 2FA phishing kit has undergone several enhancements to increase its stealth and obfuscation methods, making it harder for security tools to detect. For example, the latest versions contain special source code to obstruct web page analysis by defenders, prevent users from copying meaningful text from the phishing webpages, and disable the right-click menu to prevent offline analysis [4].

Conclusion

Threat actors are continually employing new methods to bypass security detection tools and measures. As highlighted in this blog, even robust security mechanisms like MFA can be compromised using AitM phishing kits. The misuse of legitimate services such as Milanote for malicious purposes can help attackers evade traditional email security solutions by blurring the distinction between legitimate and malicious content.

This is why security tools based on anomaly detection are crucial for defending against such attacks. However, user awareness is equally important. Delays in processing can impact the speed of response, making it essential for users to be informed about these threats.

[related-resource]

Appendices

References

[1] https://www.darktrace.com/resources/annual-threat-report-2024

[2] https://www.validin.com/blog/tycoon_2fa_analyzing_and_hunting_phishing-as-a-service_domains

[3] https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/#h-iocs-amp-technical-details

[4] https://blog.barracuda.com/2025/01/22/threat-spotlight-tycoon-2fa-phishing-kit

[5] https://spur.us/context/38.242.7.252

[6] https://any.run/report/5ef1ac94e4c6c1dc35579321c206453aea80d414108f9f77abd2e2b03ffbd658/be5351d9-53c0-470b-8708-ee2e29300e70

Indicators of Compromise (IoCs)

IoC Type Description + Probability

89.185.80[.]19 - IP Address - Malicious login

5.181.3[.]68 - IP Address -Malicious login

38.242.7[.]252 - IP Address - Malicious login and new email inbox rule creation - Hide My Ass VPN

lrn.ialeahed[.]com – Hostname - Likely Tycoon 2FA domain

Darktrace Model Detections

Email alerts

Platforms / Free Content Sender + High Sender Surge

Platforms / Free Content Sender + Sender Surge

Platforms / Free Content Sender + Unknown Initiator

Platforms / Free Content Sender

Platforms / Free Content Sender + First Time Recipient

Unusual / New Sender Surge

Unusual / Sender Surge

Antigena Anomaly / High Antigena Anomaly

Association / Unknown Sender

History / New Sender

Link / High Rarity Link to File Storage

Link/ Link To File Storage

Link / Link to File Storage + Unknown Sender

Link / Low Link Association

Platforms / Free Content Sender + First Time Initiator

Platforms / Free Content Sender + Unknown Initiator + Freemail

Platforms / Free Content Sender Link

Unusual / Anomalous Association

Unusual / Unlikely Recipient Association

IDENTITY

SaaS / Access / Unusual External Source for SaaS Credential Use

SaaS / Compromise / Login from Rare High Risk Endpoint

SaaS / Access / M365 High Risk Level Login

SaaS / Compromise / Login From Rare Endpoint While User Is Active

SaaS / Access / MailItemsAccessed from Rare Endpoint

SaaS / Unusual Activity / Multiple Unusual SaaS Activities

SaaS / Unusual Activity / Multiple Unusual External Sources For SaaS Credential

SaaS / Compliance / Anomalous New Email Rule

SaaS / Compromise / Unusual Login and New Email Rule

SaaS / Compromise / SaaS Anomaly Following Anomalous Login

Antigena / SaaS / Antigena Suspicious SaaS Activity Block

Antigena / SaaS / Antigena Enhanced Monitoring from SaaS User Block

Antigena / SaaS / Antigena Unusual Activity Block

Antigena / SaaS / Antigena Suspicious SaaS and Email Activity Block

Cyber AI Analyst Incident

Possible Hijack of Office365 Account

MITRE ATT&CK Mapping

Tactic – Technique

DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - Cloud Accounts

INITIAL ACCESS - Phishing

CREDENTIAL ACCESS - Steal Web Session Cookie

PERSISTENCE - Account Manipulation

PERSISTENCE - Outlook Rules

RESOURCE DEVELOPMENT - Email Accounts

RESOURCE DEVELOPMENT - Compromise Accounts

Experts breakdown of Identity Security in the Cloud Era

This white paper discusses the current identity threat landscape and how defenders can adopt new tools to better secure their users and data.

Inside the SOC

Written by

Alexandra Sentenac

Cyber Analyst

Cyber Security Analyst

•

June 11, 2026

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Watch the NIS2 Webinar

Blog

Network

June 15, 2026

Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining

Introduction

In enterprise environments, non-compliant software traffic can introduce unexpected exposure by creating unmanaged paths for outbound connectivity. Hola VPN is a notable example because of its peer-to-peer design, which can effectively turn user devices into routing or exit nodes for other parties’ traffic, shifting the risk profile from that of a traditional virtual private network (VPN) to something closer to a distributed proxy.

As a result, the appearance of Hola-related activity, whether from prior installation or unintended background connections, should be treated with caution. Such activity may provide a foothold for malicious behavior, including lateral movement or command-and-control communication.

This blog explores how Hola-associated activity appeared as part of broader patterns of suspicious behavior observed across the Darktrace customer base.

The campaign

In February and March 2026, Darktrace observed similar anomalous activity across multiple customer environments, with affected devices showing consistent behavioral patterns. These included connections to multiple *.hola[.]org endpoints using Hola-related user agents, suggesting interaction with Hola infrastructure rather than isolated or incidental traffic.

Following these connections, affected customer environments showed downloads of suspicious executable files from rare external endpoints 188.241.219[.]55 and 184.241.218[.]111. Both endpoints have been flagged as potentially malicious by open-source intelligence (OSINT) [1][2].

These downloads were conducted using consistent user agents across impacted customers, specifically ‘Hola svc_js_win32/1.249.408’ and ‘Hola svc_js_win32/1.251.389’, suggesting a possible association with Hola-related activity.

Notably, this pattern aligns with recent reporting that, in some cases, Hola distributed an undeclared executable component, me[.]exe, which was later assessed to be a likely Monero-mining binary introduced via a compromised delivery pipeline [3].

Case Study 1

Darktrace first observed a new device on January 19, 2026, within a customer environment based in the Europe, Middle East, and Africa (EMEA) region. On the same day it appeared on the network, the device communicated with multiple pieces of Hola VPN-linked infrastructure before downloading a binary from a hola[.]org subdomain.

Figure 1: Cyber AI Analyst investigation highlighting Hola VPN service activity potentially associated with subsequent HTTP command-and-control (C2) connections.

Subsequent Darktrace telemetry revealed a recurring pattern of activity from the day the device was first observed through to March 4, 2026. During this period, the device repeatedly issued HTTP GET requests to the URI /bwfile?size=1048576, each returning a 200 OK response, indicating successful file retrieval.

This behavior was accompanied by a POST request to /bwfile, followed by an additional GET request for a significantly larger file at /bwfile?size=26214400, suggesting a deliberate and structured file transfer pattern.

Notably, the binary download activity was not tied to a single static host. Instead, it was observed across multiple URLs that changed over time while remaining within the same hola[.]org domain. This pattern suggests the use of rotating or distributed delivery infrastructure rather than a fixed endpoint.

Figure 2: Variation in URLs over time within the same hola[.]org domain, indicating the use of dynamically changing endpoints.

Across these events, the activity was consistently associated with the user agent Hola svc_js_win32/1.249.408, further linking the traffic to Hola-related service components. Amid these persistent and unusual connections, on February 22, Darktrace observed the device connecting to 188.241.219[.]55/proxy-peer-windows-amd64[.]exe, resulting in the download of an executable file.

Figure 3: File transfer event showing the download of an executable from the rare external endpoint 188.241.219[.]55.

Based on its file hash, the downloaded file was assessed as a likely Trojan downloader [4], with import hash (imphash) values showing similarities to samples linked to Vidar, Rhadamanthys, and Stealc according to OSINT [5]. Overall, this sequence of activity suggests that Hola-related connectivity may have been leveraged as part of a broader malware delivery chain.

Darktrace’s Autonomous Response

Due to the highly unusual activity observed, Darktrace Autonomous Response was triggered by the device’s behavior. However, as the customer deployment was configured in “Human Confirmation” mode, manual approval was required before any action could be taken.

Had the deployment been set to “Fully Autonomous” mode, Darktrace would have automatically:

Blocked connections to the associated ports and external endpoints
Prevented all outgoing network connections from the device
Enforced the device’s established ‘pattern of life’, allowing normal activity to continue while restricting any anomalous behavior

Figure 4: Example of a Darktrace Autonomous Response model highlighting the action that would have been taken, demonstrating how the system identifies anomalous behavior and applies targeted containment measures to restrict suspicious network activity.

Case Study 2

While the first case focused on anomalous activity from a newly observed device, Darktrace also identified cases in which devices had already been communicating with Hola-related endpoints prior to the suspected campaign. This may suggest pre-existing Hola usage within the environment, potentially increasing exposure and creating an avenue for subsequent suspicious activity.

One case involved three devices within a customer network based in the Americas (AMS). In this instance, a different payload was identified: me[.]exe, a potentially malicious cryptocurrency miner also referred to as HolaMonitorService[.]exe [6][7]. The downloads were observed from infrastructure similar to that seen in Case 1, including an IP address within the same 188.241.0.0/16 subnet.

Connections to *.hola[.]org, alongside the use of potential Hola-related user agents consistent with those in Case 1, were also identified, further suggesting a link between the observed activity and Hola-associated infrastructure.

Darktrace observed activity indicative of unusual VPN usage on the first affected device on February 2, followed by telemetry suggesting potential Tor usage. This was later followed by the download of me[.]exe on March 10 from 188.241.218[.]111. Notably, this device was the earliest among the three within the deployment to exhibit the presence of the suspicious executable.

Figure 5: Cyber AI Analyst detection highlighting the download of a suspicious executable from a similar external endpoint in a separate deployment.

On March 5, 2026, the second affected device exhibited a slightly different progression, initiating connections to http-test1[.]hola[.]org using the user agent ‘hola_get’. This activity was followed by the download of me[.]exe from the same endpoint on March 13, consistent with the broader pattern of Hola-related downloads observed across the environment.

Figure 6: Example of Hola VPN-related connectivity observed on the network prior to the suspected campaign, indicating pre-existing usage that may have contributed to subsequent activity.

The final affected device within this customer’s network demonstrated a more limited but related pattern, also downloading me[.]exe on March 17 using the same ‘hola_get’ user agent.

While the earlier Hola VPN usage observed across the deployment may not have been directly related to the suspected malware campaign, it may nonetheless have contributed to reduced visibility. The presence of pre-existing Hola-related traffic could have obscured malicious activity, making it more difficult to distinguish legitimate usage from attacker-driven behavior and, in turn, hindering the timely identification of the emerging compromise.

Darktrace’s Autonomous Response

For this deployment, the customer had their Autonomous Response capability configured in “Fully Autonomous” mode, allowing Darktrace to take action without human intervention. As a result, the system was able to autonomously disrupt the activity as soon as relevant events were identified through model detections.

Figure 7: Darktrace Autonomous Response actions taken against suspicious activity linked to Hola VPN.

Suspected cryptomining activity

As previously noted, some of the observed executable payloads appear to be linked to cryptomining malware. Across a subset of affected customer environments, this assessment was further supported by subsequent device activity consistent with Monero mining. Affected devices established follow-on connections to multiple external endpoints aligned with known mining infrastructure, indicating post-download execution.

Considering the broader sequence of activity, this pattern may point to a wider form of abuse in which legitimate VPN-related traffic is used to mask or facilitate malicious behavior following compromise.

On several devices, the download of executable files, including a newly observed peer[.]exe, was followed by alerts indicative of cryptocurrency mining activity. Mining-related credentials such as ‘x’ were observed using the Minergate protocol to communicate with endpoints within the 89.125.255.0/24 subnet and 188.241.218[.]111, the same endpoint involved in earlier download activity. Additional credentials appeared to reflect device-specific CPU identifiers, for example ‘12th Gen Intel(R) Core (TM) i5-1235U’.

Observed mining methods included login, submit, and job, consistent with active participation in a pool-based mining workflow rather than passive or incidental contact. The login method indicates that the host authenticated to the mining service as a worker, job reflects the assignment of computational tasks, and submit shows completed work being returned to the pool [8]. This sequence suggests that affected devices were actively contributing processing resources as part of an unauthorized distributed mining operation.

The presence of unauthorized cryptominers can lead to degraded system performance and reduced device stability. Beyond the immediate resource impact, such activity often serves as an indicator of a broader compromise rather than an isolated issue. This may increase the risk of further malware deployment, persistence mechanisms, and lateral movement, particularly in environments where the initial intrusion has not been fully contained.

Conclusion

Across affected environments, detections such as unusual VPN usage, connections to Hola infrastructure, anomalous HTTP activity, suspicious file downloads, and subsequent cryptomining behavior were linked into a single, evolving incident narrative. This aggregation provided a clearer view of attack progression, enabling security teams to understand not just isolated alerts, but the full sequence of compromise from initial contact through to post-exploitation.

Ultimately, these activities show that the risk posed by non-compliant software such as Hola VPN can extend far beyond simple policy violations. What began as traffic to Hola-related infrastructure was, in multiple cases, followed by behavior suggesting deliberate misuse, including suspicious executable downloads using Hola-related user agents and, in some instances, evidence of active cryptomining. These were not isolated anomalies, but elements of a broader pattern in which seemingly benign proxy or VPN-related communications may have created a pathway for malicious delivery and unauthorized resource exploitation.

The significance of this activity lies not only in the downloads or mining, but in what it reveals about an attacker’s ability to blend malicious operations into traffic associated with software that may already have a foothold in the environment. When unapproved software operates within an enterprise, it can reduce visibility, blur the distinction between legitimate and malicious traffic, and create opportunities to extend compromise in ways that are persistent and difficult to detect. Darktrace’s anomaly-based approach enables these behavioral distinctions to be identified, regardless of whether the device is new or long established within the network.

Credit to Min Kim (Associate Principal Analyst), Priya Thapa (Senior Cyber Analyst)
Edited by Ryan Traill (Content Manager)