hasamba<p>🎯 Threat Intelligence<br>===================</p><p>Executive summary: Tykit is a labeled phishing kit family identified from ANY.RUN sandbox sessions first seen in May 2025 with peak activity in September–October 2025. The kit delivers obfuscated JavaScript inside SVG assets, reconstructs it via XOR, executes with eval(), and redirects victims to fake Microsoft 365 login pages. Multiple samples reuse the same exfiltration endpoints and share near-identical client-side logic.</p><p>Technical details:<br>• Observed delivery vector: SVG file embedding JavaScript that rebuilds a payload using XOR and executes via eval().<br>• Observed C2 and endpoints: segy2[.]cc (POST to /api/validate) and multiple fake login domains matching the pattern used for Microsoft 365 impersonation.<br>• Sample artifact: SHA256 a7184bef39523bef32683ef7af440a5b2235e83e7fb83c6b7ee5f08286731892.<br>• Client-side behavior: staged execution with validation of the victim's current authorization state at multiple steps; layered redirects to obscure the final phishing page.</p><p>Attack chain analysis:<br>• Initial Access: SVG asset served to target (delivery vector embedded in email or web redirect).<br>• Execution: JavaScript inside SVG reconstructs payload using XOR and executes it via eval() in the browser context.<br>• Credential Harvesting: Victim is redirected to a cloned Microsoft 365 login page capturing credentials.<br>• Exfiltration: Client-side code performs POST to C2 (example /api/validate on segy2[.]cc) to send harvested data.</p><p>Analysis and scale:<br>Observed targeting includes corporate Microsoft 365 accounts across industries such as finance, professional services, IT, government, telecom, real estate and education, with geographic spread across the US, Canada, LATAM, EMEA, Southeast Asia and the Middle East. The reuse of C2 infrastructure and consistent client-side obfuscation patterns indicate an organized phishing kit rather than isolated malicious pages.</p><p>Detection (reported observations only):<br>• Look for SVG assets that include long inlined JavaScript sequences and apparent XOR decoding routines.<br>• Monitor outbound POSTs to domains like segy2[.]cc with bodies containing validation/credential-like fields.<br>• Flag login pages whose hostnames mimic Microsoft subdomains but contain long randomized tokens or atypical TLDs.</p><p>Limitations and unknowns:<br>• No public attribution to a specific actor was provided in the analyzed material.<br>• Full scope of infected targets and total credential harvest counts were not quantified in the source report.</p><p>🔹 phishing <a href="https://infosec.exchange/tags/Tykit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tykit</span></a> <a href="https://infosec.exchange/tags/Microsoft365" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft365</span></a> <a href="https://infosec.exchange/tags/svg" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>svg</span></a> <a href="https://infosec.exchange/tags/anyrun" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>anyrun</span></a></p><p>🔗 Source: <a href="https://any.run/cybersecurity-blog/tykit-technical-analysis/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">any.run/cybersecurity-blog/tyk</span><span class="invisible">it-technical-analysis/</span></a></p>