{"id":15633,"date":"2025-08-26T11:18:13","date_gmt":"2025-08-26T11:18:13","guid":{"rendered":"\/cybersecurity-blog\/?p=15633"},"modified":"2025-08-26T11:18:14","modified_gmt":"2025-08-26T11:18:14","slug":"cyber-attacks-august-2025","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/cyber-attacks-august-2025\/","title":{"rendered":"Major Cyber Attacks in August 2025: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA"},"content":{"rendered":"\n

Phishing kits and stealers didn\u2019t slow down this August, and neither did we. ANY.RUN analysts tracked some of the month\u2019s most dangerous campaigns, from a 7-stage Tycoon2FA phishing chain<\/strong> to Rhadamanthys delivered via ClickFix<\/strong>, and the discovery of Salty2FA, a brand-new PhaaS framework linked to Storm-1575<\/strong>. <\/p>\n\n\n\n

All were analyzed inside ANY.RUN\u2019s Interactive Sandbox<\/strong><\/a>, revealing full execution chains, decrypted traffic, and behavior missed by static tools. Combined with Threat Intelligence Lookup<\/strong><\/a>, these insights help SOC teams turn raw IOCs into actionable detection rules and cut investigation time when it matters most. <\/p>\n\n\n\n

Let\u2019s explore how these attacks worked, what they targeted, and the insights SOC teams can take away. <\/p>\n\n\n\n

Tycoon2FA: New 7-Stage Phishing Attack Beats Top Security Systems <\/h2>\n\n\n\n

Post on X<\/strong><\/a> <\/p>\n\n\n\n

ANY.RUN analysts uncovered a multi-stage <\/strong>Tycoon2FA campaign<\/strong><\/a> that takes phishing beyond the usual fake login page. Instead, it runs victims through a seven-step execution chain<\/strong> packed with CAPTCHAs, button-hold checks, and validation screens; each designed to wear down humans and outsmart automated security tools. By the time the final phishing panel appears, most defenses have already failed. <\/p>\n\n\n\n

Unlike mass phishing kits that cast a wide net, Tycoon2FA is highly selective<\/strong>. It goes after accounts that unlock access to critical systems and sensitive data<\/strong>, not just ordinary inboxes. <\/p>\n\n\n

\n
\"\"
Key industries targeted by Tycoon2FA<\/em> <\/figcaption><\/figure><\/div>\n\n\n

Recent campaigns have zeroed in on government and military agencies<\/strong>, as well as financial institutions<\/strong> ranging from global banks to regional insurers. Activity has been observed across the US, UK, Canada, and Europe<\/strong>, where a single stolen login can cause major financial losses or even disrupt national operations. <\/p>\n\n\n\n

ANY.RUN data shows that 26% of Tycoon2FA cases analyzed in our sandbox involved the banking sector; <\/strong>clear evidence that attackers are deliberately aiming at high-value targets. <\/p>\n\n\n\n

7-Stage Execution Flow Exposed inside ANY.RUN <\/h3>\n\n\n\n

In a recent ANY.RUN analysis, Tycoon2FA unfolded in this order: <\/p>\n\n\n\n

Check Real Case: Multi-Stage Tycoon2FA Attack<\/a> <\/p>\n\n\n

\n
\"\"
Execution chain of multi-stage Tycoon2FA campaign<\/em> <\/figcaption><\/figure><\/div>\n\n\n
    \n
  1. Phishing email link \u2192<\/strong> The attack begins with a voicemail-themed phishing email containing a malicious link to lure the victim. <\/li>\n<\/ol>\n\n\n\n
      \n
    1. PDF attachment \u2192<\/strong> Clicking the link triggers a fake PDF download, masking the next redirection step. <\/li>\n<\/ol>\n\n\n\n
        \n
      1. Link inside PDF \u2192<\/strong> The PDF itself hides another embedded hyperlink, pushing the victim deeper into the chain. <\/li>\n<\/ol>\n\n\n\n
          \n
        1. Cloudflare Turnstile CAPTCHA \u2192<\/strong> A CAPTCHA challenge filters out automated scanners by requiring human interaction. <\/li>\n<\/ol>\n\n\n\n
            \n
          1. \u201cPress & Hold\u201d anti-bot check \u2192<\/strong> A second verification forces a hold-and-release gesture, further blocking automation. <\/li>\n<\/ol>\n\n\n\n
              \n
            1. Email validation page \u2192<\/strong> The victim is asked to \u201cverify\u201d their email, confirming they are real and a worthwhile target. <\/li>\n<\/ol>\n\n\n\n
                \n
              1. Final phishing panel \u2192<\/strong> At the end, a fake Microsoft login page is revealed, ready to steal the victim\u2019s credentials. <\/li>\n<\/ol>\n\n\n\n

                With ANY.RUN\u2019s <\/strong>Automated Interactivity<\/strong><\/a>, analysts can replicate each click and CAPTCHA, exposing the entire chain in minutes. This delivers not just IOCs, but also behavioral indicators that SOC teams can fold directly into detection rules and SOAR playbooks<\/strong>, reducing investigation time and keeping attacks like Tycoon2FA from slipping through. <\/p>\n\n\n\n

                See decrypted traffic and examine the full threat context: Tycoon2FA Analysis Session<\/a>.<\/p>\n\n\n

                \n
                \"\"
                Detailed analysis of Tycoon 2FA attack inside ANY.RUN\u2019s Sandbox<\/em> <\/figcaption><\/figure><\/div>\n\n\n

                Check out the following TI Lookup search query to track Tycoon campaigns and adjust detection rules accordingly: threatName:”tycoon”<\/a>\u00a0<\/p>\n\n\n

                \n
                \"\"
                ANY.RUN Sandbox analyses with Tycoon <\/em> <\/figcaption><\/figure><\/div>\n\n\n

                Gathered IOCs:<\/strong> <\/p>\n\n\n\n