# Top Phishing-Kit Platforms Driving AiTM Session-Theft and MFA-Bypass Campaigns (SOCRadar, Aug 2026)

> SOCRadar's August 12, 2026 roundup profiles ten active phishing-as-a-service (PhaaS) platforms — Tycoon2FA, EvilProxy/Evilginx2, Sneaky 2FA, EvilTokens, BlueKit, CryptoChameleon, Darcula/darcula-suite, YYlaiyu, and Telekopye — that package adversary-in-the-middle (AiTM) session-cookie theft, OAuth device-code token theft, and smishing/vishing consumer fraud into subscription products. The most consequential single development is Tycoon2FA's survival of a March 4, 2026 Microsoft/Europol takedown (330 domains seized across six countries) and its late-April 2026 addition of device-code phishing.

- **Published:** 2026-08-15T00:00:00Z
- **Last reviewed:** 2026-08-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2024
- **ID:** TL-2026-2024
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat aggregates ten commercially available phishing-kit platforms that SOCRadar identified as currently active and responsible for the bulk of enterprise-identity and consumer phishing traffic as of August 2026. The kits split into two operational families.

The first family — Tycoon2FA, EvilProxy (the commercialized fork of the open-source Evilginx2), and Sneaky 2FA — are reverse-proxy adversary-in-the-middle (AiTM) kits. Each stands a phishing server between the victim and a real identity provider (predominantly Microsoft 365/Entra ID, plus Gmail, Google Workspace, and Okta), relays the victim's credentials and MFA response to the legitimate service in real time, and then captures the resulting authenticated session cookie. Because the attacker steals a post-MFA session token rather than a password, standard OTP/push MFA provides no protection — only phishing-resistant methods (FIDO2/WebAuthn) or immediate session/token revocation stop the takeover. Tycoon2FA was the dominant kit through most of 2025 (built by developer Saad Fridi, marketed via Telegram, ~2,000 subscribers, $120/10-days pricing), driving an estimated 96,000 distinct victims and 55,000+ compromised Microsoft accounts since 2023, and accounting for roughly 62% of all phishing Microsoft blocked by mid-2025. A Microsoft Digital Crimes Unit-led technical disruption, coordinated with Europol's Cyber Intelligence Extension Programme and law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the UK, seized 330 domains forming the platform's control-panel and phishing-page infrastructure on March 4, 2026, under a U.S. District Court (SDNY) order. The operators rebuilt on new infrastructure within days and, by late April 2026, added device-code phishing to the kit — converging it with the newer EvilTokens technique described below. EvilProxy and Evilginx2 use the same AiTM mechanics against a broader identity-provider set (Microsoft 365, Okta, Google Workspace) at $150-600/month. Sneaky 2FA, tracked by Sekoia since December 2024 (campaigns dating to October 2024), is distributed through a fully automated Telegram bot and distinguishes itself with blurred real-Microsoft-interface decoy backgrounds and QR-code-based phishing lures.

The second, newer technique is represented by EvilTokens, first identified by Sekoia's Threat Detection & Research team in early March 2026 (circulating in underground channels since mid-February 2026). Rather than intercepting a password, EvilTokens abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow: a phishing page impersonating a trusted service (Adobe, DocuSign, SharePoint) prompts the victim to copy a device code and complete authentication on Microsoft's genuine login page. Because the victim is authenticating to a real Microsoft URL, the flow bypasses the credential-phishing detections that catch fake-login-page kits. The attacker's backend then receives a short-lived access token and a 90-day rolling refresh token, converts it into a Primary Refresh Token for SSO hijacking, and can perform Graph API reconnaissance across the compromised tenant. Over 1,000 domains were hosting EvilTokens phishing pages by March 23, 2026, and the operator plans to expand targeting to Gmail and Okta.

Beyond enterprise identity, BlueKit is a newly observed AI-powered all-in-one PhaaS dashboard offering 40+ brand templates, automated domain registration, geolocation spoofing, antibot cloaking, and — as of its most recent update — browser-in-the-middle (BitM) session hijacking alongside an AI assistant and voice-cloning add-on. CryptoChameleon runs multi-channel (email/SMS/voice) social-engineering campaigns against cryptocurrency-exchange users and FCC employees, gating its phishing pages behind hCaptcha to block automated crawlers; its TTPs resemble the 2022 Oktapus/Scattered Spider campaign without confident attribution. Darcula (and its v3 darcula-suite evolution) is a Chinese-language PhaaS platform that automates cloning of any brand's website via headless-Chrome browser automation, primarily supporting SMS-based (smishing) package-delivery and financial-fraud lures; it has been linked to 90,000+ detected phishing domains and over 800,000 claimed victims. YYlaiyu, documented by Google's Threat Intelligence Group in May 2026 as part of the broader Chinese-language phishing ecosystem, has offered 400+ localized templates since November 2025 across 119 countries with a Japan-specific focus (Amazon, Rakuten, PayPay, JR Rail, etc.), and is tracked across 2,158+ domains as of October 2025. Telekopye (tracked by Group-IB as overlapping with Classiscam) is a Telegram-bot-driven fraud toolkit that lets low-skilled operators ('Neanderthals') run online-marketplace seller/buyer/refund scams, generating phishing pages and fake screenshots on demand.

Collectively these platforms illustrate that phishing-resistant MFA (FIDO2/WebAuthn passkeys) and Conditional Access controls restricting the OAuth device-code flow are now the only reliable mitigations against enterprise-identity phishing; OTP and push-based MFA are routinely defeated at scale by commodity, subscription-priced criminal tooling.

## MITRE ATT&CK

- T1598.003 Phishing for Information: Spearphishing Link
- T1598.004 Phishing for Information: Spearphishing Voice
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1660 Phishing
- T1204.001 User Execution: Malicious Link
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1187 Forced Authentication
- T1056.003 Input Capture: Web Portal Capture
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1550.001 Use Alternate Authentication Material: Application Access Token

## Sources

- [Top 10 Phishing Kits Used by Cybercriminals](https://socradar.io/blog/top-phishing-kits-cybercriminals/)
- [Defending the gates: How a global coalition disrupted Tycoon 2FA](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/)
- [Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks](https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html)
- [Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit](https://www.sekoia.com/blog/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [The Bleeding Edge of Phishing: darcula-suite 3.0 Enables DIY Phishing of Any Brand](https://www.netcraft.com/blog/darcula-v3-phishing-kits-targeting-any-brand)
- [Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026)](https://cybersecuritynews.com/top-10-phishing-kits-used-by-hackers/)
- [Most popular phishing kits used in 2026](https://www.paubox.com/blog/most-popular-phishing-kits-used-in-2026)
- [Researchers discover new all-in-one 'Bluekit' phishing kit capable of bypassing enterprise 2FA protocols and emulating 40+ global brands](https://www.techradar.com/pro/security/researchers-discover-new-all-in-one-bluekit-phishing-kit-capable-of-bypassing-enterprise-2fa-protocols-and-emulating-40-global-brands)
- [Phishing kit YYlaiyu impersonates 97 brands for fraud](https://www.theregister.com/2025/10/10/chinese_phishing_kit_fraud/)
- [More Than Meets the YY: Analyzing the YYlaiyu PhaaS Panel](https://spycloud.com/blog/yylaiyu-chinese-phishing-as-a-service-panel/)
- [Telekopye: Hunting Mammoths using Telegram bot](https://www.welivesecurity.com/en/eset-research/telekopye-hunting-mammoths-using-telegram-bot/)
- [CryptoChameleon Attackers Target Apple, Okta Users](https://www.darkreading.com/application-security/cryptochameleon-attackers-target-apple-okta-users-tech-support-gambit)
- [Hackers target FCC, crypto firms in advanced Okta phishing attacks](https://www.bleepingcomputer.com/news/security/hackers-target-fcc-crypto-firms-in-advanced-okta-phishing-attacks/)
- [The Evolution of Chinese-Language Phishing Services](https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2024