{"id":16400,"date":"2025-10-21T10:31:58","date_gmt":"2025-10-21T10:31:58","guid":{"rendered":"\/cybersecurity-blog\/?p=16400"},"modified":"2025-10-22T06:31:48","modified_gmt":"2025-10-22T06:31:48","slug":"tykit-technical-analysis","status":"publish","type":"post","link":"\/cybersecurity-blog\/tykit-technical-analysis\/","title":{"rendered":"Tykit Analysis: New Phishing Kit\u00a0Stealing Hundreds of Microsoft Accounts in Finance\u00a0"},"content":{"rendered":"\n

Not long ago we reported a spike in phishing attacks that use an SVG file as the delivery vector. One striking detail was how the SVG embeds JavaScript that rebuilds the payload with XOR and then executes it directly via eval() to redirect victims to a phishing page. <\/p>\n\n\n\n

A quick look at the indicators we found showed that nearly all related cases used the same exfiltration addresses. Even more telling: the client-side logic and obfuscation techniques were unchanged across samples, and the communication with the C2 servers was implemented in several steps, with validation of the victim\u2019s current authorization state at each stage. <\/p>\n\n\n\n

All this suggests the threat has a certain level of maturity; it\u2019s not just an unusual delivery method, but something that behaves like a phishing kit<\/a>. <\/p>\n\n\n\n

To test that hypothesis, measure the scale of the problem, and be able to tell this threat apart from others, we performed a technical analysis of the samples and labeled the family Tykit (Typical phishing kit)<\/strong>. Here\u2019s what we found. <\/p>\n\n\n\n

Key Takeaways <\/h2>\n\n\n\n