Tycoon 2FA Phishing Kit Domain Activity

Frederico Canhoto@nullwhire

•updated Jul 12, 2025•4•2•81

This rule detects network connections or DNS queries to domains associated with the Tycoon 2FA phishing kit. The rule leverages an external data source containing a list of known malicious domains used by this phishing kit. Detection occurs if a device attempts to connect to or resolve any of these domains.