Tycoon Establishes a Socket IO Control Channel

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•3

Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.