Threat reportPhishingTL-2026-1777
AiTM Phishing Becomes Top Initial Access Vector for Law Firms: Tycoon2FA, ClickFix/NetSupport RAT, Teams Vishing (STAC4749), and Lumma Stealer Converge on the Legal Sector
AiTM Phishing Becomes Top Initial Access Vector for Law (TL-2026-1777), also tracked as Legal Sector AiTM Phishing Wave, is a high-severity phishing campaign, first published 2026-07-30. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID (Outlook, SharePoint, OneDrive), maps to 31 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 36 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 31MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 36Indicators of compromise
Key facts for TL-2026-1777
- Threat ID
- TL-2026-1777
- Also known as
- Legal Sector AiTM Phishing Wave, Tycoon2FA Campaign, STAC4749 Teams Vishing Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- legal, professional services, government administration, health, finance, education, non-profit organisation, manufacturing, energy, construction
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in AiTM Phishing Becomes Top Initial Access Vector for Law
Malware and tooling: CASTLELOADER, Chaos ransomware, FlowerStorm, Latrodectus - S1160, Lumma Stealer - S1213, NetSupport RAT, Sneaky2FA, Tycoon2FA, Cloudflare Turnstile, NetSupport Manager, javascript-obfuscator, socket.io
How AiTM Phishing Becomes Top Initial Access Vector for Law works
eSentire's Threat Response Unit reports Adversary-in-the-Middle (AiTM) phishing now accounts for 28.57% of initial access events against legal-sector organizations, driven primarily by the Tycoon2FA phishing-as-a-service platform (52.3% of AiTM-related account compromises) despite a March 2026 Europol/Microsoft-led takedown of its infrastructure. The same legal-sector threat surface is being hit by ClickFix fake-CAPTCHA campaigns delivering NetSupport RAT, Microsoft Teams helpdesk-impersonation vishing (tracked as STAC4749) that has led to Chaos ransomware deployment in under 17 hours, and Lumma Stealer infostealer activity, together producing an 86% overall intrusion ratio and a 23% ransomware intrusion rate.
Legal-sector organizations experienced a 20% year-over-year rise in security incidents in 2025-2026, with credential- and identity-focused activity (account compromise plus direct credential phishing) comprising 56.3% of all observed threats, per eSentire TRU's Legal Services Threat Intelligence Spotlight. The dominant driver is Adversary-in-the-Middle (AiTM) phishing, which reverse-proxies the real authentication flow of Microsoft 365, Outlook, SharePoint, OneDrive, and Gmail so that a victim who enters correct credentials and completes an MFA challenge still hands the attacker a valid, replayable session cookie -- fully defeating password + OTP/push MFA without touching the identity provider itself.
The leading AiTM engine is Tycoon2FA, a subscription phishing-as-a-service (PhaaS) platform sold via Telegram and Signal ($120/10 days or $350/month for a web admin panel) that has been active since August 2023 and, at its peak, accounted for roughly 62% of all phishing attempts blocked by Microsoft. Tycoon2FA operates a six-stage flow: a Cloudflare Turnstile CAPTCHA gate ('this page is running browser checks to ensure your security'), regex-based victim-email extraction, a redirection page with heavily obfuscated JavaScript (javascript-obfuscator hex-renamed variables, base64/base91 encoding, dead-code injection, invisible Unicode), a spoofed Microsoft/Google/DocuSign/Adobe login page, real-time relay of push/OTP/phone MFA challenges to the legitimate service via a reverse proxy, and final capture of the resulting session cookie over a socket.io WebSocket channel, with stolen data forwarded through Telegram bot channels. Infrastructure rotates rapidly -- FQDNs live only 24-72 hours, are increasingly hosted behind Cloudflare, and use low-verification generic TLDs (.space, .email, .solutions, .live, .today, .calendar) after early campaigns leaned on .es/.ru. Anti-analysis controls filter datacenter and Tor-exit IPs, bot user agents, and automation tooling (PhantomJS, Burp Suite, dev-tools detection). On March 4, 2026, Europol, Microsoft's Digital Crimes Unit, and industry partners (Cloudflare, Coinbase, eSentire, Intel 471, Proofpoint, SpyCloud, Trend Micro, Health-ISAC, Shadowserver, Resecurity, Crowell) seized 330 domains tied to Tycoon2FA's core infrastructure, following prior disruptions of the Caffeine and RaccoonO365 phishing supply chains; by April 2026, Barracuda reported the operators had 'scattered' rather than folded, redistributing across a more fragmented AiTM-kit ecosystem alongside competing PhaaS brands Sneaky2FA and FlowerStorm.
A second major legal-sector vector is ClickFix, a social-engineering technique (not a single malware family) reaching 13.39% of legal incidents versus an 8.77% cross-industry average. Fake browser-error or CAPTCHA pages -- themed as a document viewer, e-filing system, or court-portal notice -- instruct the victim to press Win+R and paste a clipboard string that is actually a PowerShell command, or (in an mshta.exe-based variant) fetch and execute a remote HTML application. A February 2026 Microsoft disclosure documented a DNS-based evolution where the pasted command runs nslookup against an attacker-controlled DNS server and executes the payload returned in the response's Name: field, bypassing URL-based blocking entirely. ClickFix campaigns targeting the legal sector primarily deliver NetSupportManager RAT (26.2% of all legal-sector malware detections), a legitimate dual-use remote-administration tool abused as a RAT: it drops client32.exe alongside a client32.ini configuration file containing a C2 gateway address and encrypted Global Security Key, uses the network User-Agent 'NetSupport Manager/1.3', beacons over TCP/443, and grants attackers keyboard/mouse lock, screen and audio capture, file transfer, and command execution -- with observed post-compromise activity including Impacket-based lateral movement and ProcDump credential dumping. Elsewhere, ClickFix lures also deliver Lumma Stealer (9.6% of legal-sector malware; infostealers overall 30.4%), Latrodectus, and DarkGate. Lumma Stealer (LummaC2), a malware-as-a-service infostealer active since late 2022, resumed distribution via the CastleLoader loader after a May 2025 law-enforcement disruption and was documented by Microsoft in a Windows Terminal-based delivery variant on March 5, 2026; it exfiltrates over the Telegram Bot API (api.telegram.org), making outbound connections to that domain from non-Telegram processes a high-fidelity behavioral detection.
A third vector is abuse of Microsoft Teams external access -- specifically the tenant-default 'Chat with Anyone' setting -- reaching 6.25% of legal-sector initial access events versus 3.40% cross-industry. Sophos tracks a cluster as STAC4749: attackers register external Teams accounts under IT-support-styled names (e.g., AnthonyBrooks, DylanHarper, EthanParker, EllaBrooks) on lookalike domains (sequrityupdate.top, scan-security.top, system-connect.top, service-help.top) and impersonate helpdesk staff via Teams chat and voice calls, timed during business hours, to talk victims into granting remote access. Between February and June 2026, Sophos observed STAC4749 targeting dozens of North American organizations (about 50% Canada, 45% US) across services, manufacturing, energy, construction, and intellectual-property law firms; in at least three incidents this access chain culminated in Chaos ransomware deployment, one in under 17 hours from initial contact to encryption. Chaos is a ransomware-as-a-service operation active since at least February 2025 believed to include former BlackSuit and Royal ransomware affiliates. Microsoft's April 18, 2026 human-operated-intrusion playbook on cross-tenant helpdesk impersonation documents matching TTPs. Overall, eSentire TRU recorded an 86% intrusion ratio (activity beyond mere initial access) and a 23% ransomware intrusion rate across the legal-sector customer base, and separately found 28% of Business Email Compromise cases traced back to PhaaS platforms including Tycoon2FA and FlowerStorm -- underscoring that stolen sessions convert rapidly into financial fraud and ransomware, not just mailbox access.
MITRE ATT&CK techniques used in TL-2026-1777
Credential Access
T1003 OS Credential Dumping; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle; T1621 Multi-Factor Authentication Request Generation
Collection
T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
execution
stealth
T1218.005 Mshta; T1684.001 Impersonation
Impact
T1486 Data Encrypted for Impact
lateral-movement
Lateral Movement
Resource Development
T1583.001 Domains; T1584.004 Server; T1608.001 Upload Malware
Reconnaissance
Affected products and versions in AiTM Phishing Becomes Top Initial Access Vector for Law
- Microsoft — Microsoft 365 / Entra ID (Outlook, SharePoint, OneDrive)
Vulnerable versions: cloud tenants relying on password + OTP/push MFA without phishing-resistant authentication
Fixed in: tenants enforcing FIDO2/passkey phishing-resistant MFA plus Continuous Access Evaluation - Google — Google Workspace / Gmail
Vulnerable versions: accounts using OTP/push-based MFA
Fixed in: accounts enforcing FIDO2 security keys or passkeys - NetSupport Ltd — NetSupport Manager
Vulnerable versions: v14.10 and other legitimate builds deployed unauthorized as a dual-use RAT
Fixed in: N/A -- legitimate remote-administration software abused, not a vulnerable product; mitigation is allowlisting/detection - Microsoft — Microsoft Teams
Vulnerable versions: tenants with default-enabled external 'Chat with Anyone' access
Fixed in: tenants restricting or allow-listing external Teams communication
Remediation for AiTM Phishing Becomes Top Initial Access Vector for Law
Patches
- No vendor patch applies -- this is a technique/infrastructure-driven campaign, not a software vulnerability; mitigation is configuration and detection-based
Immediate actions
- Block known Tycoon2FA C2/phishing domains and STAC4749 lookalike domains at email gateway and web proxy
- Restrict or disable Microsoft Teams 'Chat with Anyone' external access, or allow-list only verified trusted domains
- Alert on execution of client32.exe/client32.ini/PCICTLUI.EXE outside standard NetSupport install paths (Program Files)
- Alert on outbound connections to api.telegram.org from non-Telegram processes
- Force re-authentication and revoke active sessions/refresh tokens for any account with anomalous sign-in following a helpdesk-impersonation contact or ClickFix-style prompt
Workarounds
- Disable default external Teams chat access tenant-wide pending a documented business justification and allow-list process
- Application-allowlist NetSupport Manager and equivalent remote-admin tools; block execution from Downloads/Temp/Roaming/Public directories
Longer-term hardening
- Migrate high-value users (partners, e-discovery, trust accounting) to phishing-resistant FIDO2/WebAuthn hardware keys or passkeys instead of OTP/push MFA
- Enforce Continuous Access Evaluation (CAE) and Conditional Access token-binding to shorten the usable lifetime of stolen session cookies
- Deploy EDR with behavioral detection tuned to ClickFix (Win+R/mshta.exe/PowerShell paste-and-run), NetSupport RAT, and Lumma Stealer TTPs rather than static IOCs, which rotate rapidly
- Run recurring security-awareness training specifically covering ClickFix fake-CAPTCHA prompts and Teams/voice helpdesk-impersonation vishing
- Establish an out-of-band verification process for any IT-support contact requesting remote-access tooling or credential/MFA re-entry
Weaknesses (CWE) in AiTM Phishing Becomes Top Initial Access Vector for Law
Timeline of AiTM Phishing Becomes Top Initial Access Vector for Law
- Tycoon2FA operators register tycoongroup.ws, among the earliest identified core AiTM command infrastructure domains for the platform.
- codecrafterspro.com is registered and used as a Tycoon2FA central command server, per Sekoia tracking.
- Tycoon2FA operators add datacenter-IP, Tor-exit-node, and bot-user-agent filtering to its phishing kit to evade automated scanners and researchers.
- ClickFix fake-CAPTCHA campaigns delivering NetSupport RAT begin, active since at least August 2024 per Anvilogic tracking.
- Sophos begins observing the STAC4749 Microsoft Teams vishing campaign impersonating IT helpdesk staff to gain remote access; the campaign runs through June 2026.
- Microsoft discloses a DNS TXT-record-based ClickFix variant where the pasted clipboard command runs nslookup against an attacker-controlled DNS server and executes the payload returned in the response, bypassing URL-based blocking.
- Europol, Microsoft's Digital Crimes Unit, and industry partners (Cloudflare, Coinbase, eSentire, Intel 471, Proofpoint, SpyCloud, Trend Micro, Health-ISAC, Shadowserver, Resecurity, Crowell) seize 330 domains in a coordinated takedown of Tycoon2FA, which had enabled over 64,000 phishing attacks and, at its peak, accounted for roughly 62% of phishing attempts blocked by Microsoft.
- Microsoft Threat Intelligence discloses a Windows Terminal-based delivery variant for Lumma Stealer.
- Barracuda reports Tycoon2FA infrastructure has 'scattered' post-takedown, with operators redistributing across smaller, more resilient AiTM kits (alongside Sneaky2FA and FlowerStorm) rather than ceasing operations.
- Microsoft publishes a human-operated-intrusion playbook documenting cross-tenant helpdesk impersonation leading to data exfiltration, describing TTPs matching the STAC4749 Teams-vishing initial-access pattern.
- Sophos's STAC4749 observation window closes, having documented dozens of targeted North American organizations -- including intellectual-property law firms -- with at least three intrusions culminating in Chaos ransomware deployment, one in under 17 hours from initial access to encryption.
- eSentire's Threat Response Unit publishes its Legal Services Threat Intelligence Spotlight, reporting AiTM phishing as 28.57% of legal-sector initial access events, Tycoon2FA behind 52.3% of AiTM account compromises, and an 86% overall intrusion ratio with a 23% ransomware intrusion rate.
Sources cited for AiTM Phishing Becomes Top Initial Access Vector for Law
- AiTM Phishing Is Top Entry Point for Law Firm Attacks
- Legal Threat Intelligence: Protecting Your Law Firm's Data, Clients, and Reputation
- Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
- Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit
- Tycoon 2FA: A Technical Analysis of its Adversary-in-the-Middle Phishing Operation
- Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks
- Authorities pull plug on Tycoon 2FA phishing-as-a-service platform
- Threat Spotlight: Tycoon 2FA didn't die — it's scattered everywhere
- Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers
- NetSupport RAT Expands with ClickFix Attack Technique
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
- Chaos in Teams vishing
- Microsoft Teams vishing attacks lead to Chaos ransomware attacks
- Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
Detection coverage for TL-2026-1777
As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1777 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.