Tycoon2FA - AiTM URI Pattern Recognition (T1566)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•14

This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.