Threat Intelligence / Actor / Unknown (likely Phishing-as-a-Service operator; TTPs overlap with Tycoon 2FA / Mamba 2FA / Caffeine kits)

Unknown (likely Phishing-as-a-Service operator; TTPs overlap with Tycoon 2FA / Mamba 2FA / Caffeine kits)

1 tracked threat(s) · Categories: PHISHING

Also known as: Nested Delivery Matrix operator, Unattributed PhaaS

Tracked threats

Nested Triple-Chain Google Domain Phishing — Microsoft SafeLinks -> meet.google.com/linkredirect -> google.com/url -> adservice.google.com.ph Evades SEGs and Lands M365 Credential Theft Plus OAuth 2.0 Device-Code Phishing (KnowBe4 ThreatLabs Nested Delivery Matrix) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence