New Tykit Phishing Kit Mimics Microsoft 365 Login Pages to Steal Corporate Account Credentials
The Tykit phishing kit is a sophisticated tool that impersonates Microsoft 365 login pages to collect corporate credentials. Initially detected in May 2025, its activity increased significantly in September and October, utilizing SVG files as a covert…
The Tykit phishing kit is a sophisticated tool that impersonates Microsoft 365 login pages to collect corporate credentials. Initially detected in May 2025, its activity increased significantly in September and October, utilizing SVG files as a covert delivery method.
Tykit's advanced obfuscation techniques and multi-stage command-and-control (C2) interactions enhance its capability as a credential theft tool. These features make it a serious threat to organizations worldwide.
Cybersecurity firm ANY.RUN has identified Tykit as a phishing-as-a-service (PhaaS) kit that effectively mimics Microsoft 365 login pages. It employs adversary-in-the-middle (AitM) techniques to capture corporate credentials.
The kit's operational framework includes SVG-based attacks, where SVG files embed JavaScript payloads. These scripts use XOR encoding to reconstruct malicious code that redirects users to fraudulent login sites.
Domains such as loginmicr0sft0nlineeckaf[.]52632651246148569845521065[.]cc are used to host phishing pages. These domains often append Base64-encoded victim emails via the "?s=" parameter. Exfiltration targets servers located on segy[.]cc variants, with data sent through staged POST requests to /api/validate and /api/login.
The Tykit phishing kit is a sophisticated tool that impersonates Microsoft 365 login pages to collect corporate credentials.
The infrastructure includes templated domains resembling domain-generation algorithms, such as ^loginmicr(o|0)s. ?.([a-z]+)?\d+.cc$ for phishing hosts and ^segy?. for C2 interactions.
Tykit's attack process involves an SVG file prompting a fake "phone number check," which accepts any input to proceed. The next step directs users to a CAPTCHA page using Cloudflare Turnstile to block bots, followed by a fraudulent Microsoft 365 login page. This process includes email verification using JSON data, session keys, and redirects.
Upon credential entry, obfuscated JavaScript transmits data to /api/login, including expired JWT tokens for authentication. Server responses dictate outcomes, and any errors prompt "incorrect password" messages, while "info" status logs activity to /x.php. This AitM setup bypasses basic MFA, making it possible to steal emails, passwords, and tokens in JSON format.
Cyber threats from Tykit affect diverse sectors, including construction, IT, finance, government, telecom, real estate, and education, mainly across the US, Canada, LATAM, EMEA, Southeast Asia, and the Middle East. Such compromises enable account takeovers, data exfiltration from SaaS apps, and lateral movement, posing risks of regulatory fines and trust erosion.
To mitigate these threats, organizations should inspect SVG content using sandboxing and content disarmament. Adopting phishing-resistant MFA solutions like FIDO2 and monitoring indicators of compromise (IOCs), such as eval() calls, Base64 parameters, and suspicious domains, is crucial. Implementing SIEM rules for /api/validate patterns and user training on recognizing anomalous "images" can help disrupt these campaigns. Proactive threat hunting is essential to counteract the evolving nature of phishing kits like Tykit.
Based on reporting by Cyber Security News.