MalwarePublished 21 Oct 2025

Tykit Analysis: New Phishing Kit Stealing Hundreds of Microsoft Accounts in Finance

Source AlienVault OTX General

Description

Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.

Impact

For European organizations, the Tykit phishing kit poses a significant threat to the confidentiality of Microsoft 365 credentials, which can lead to unauthorized access to sensitive corporate data, email compromise, and potential lateral movement within networks. Given the widespread adoption of Microsoft 365 across Europe, especially in finance, government, and professional services sectors, successful credential theft could result in data breaches, regulatory non-compliance (e.g., GDPR violations), financial fraud, and reputational damage. The multi-industry targeting and global distribution of victims indicate a broad attack surface. Additionally, compromised accounts could be leveraged for further phishing campaigns or ransomware deployment. The use of Cloudflare Turnstile complicates automated detection and blocking, increasing the risk of successful phishing attempts. The medium severity rating reflects the balance between the need for user interaction and the high impact of credential compromise in critical sectors.

Defensive guidance

European organizations should implement targeted anti-phishing training emphasizing the risks of SVG file attachments and the recognition of sophisticated phishing pages mimicking Microsoft login portals. Deploy advanced email filtering solutions capable of inspecting SVG content and detecting multi-stage phishing payloads. Integrate multi-factor authentication (MFA) for all Microsoft 365 accounts to reduce the risk of account compromise even if credentials are stolen. Monitor network traffic for suspicious API calls to known malicious domains such as segy.cc and its variants, and block these domains at the network perimeter. Employ endpoint detection and response (EDR) tools to identify and quarantine suspicious client-side script execution. Regularly update threat intelligence feeds with indicators of compromise (IOCs) including file hashes and malicious domains associated with Tykit. Conduct phishing simulation exercises tailored to the industries most affected. Finally, enforce strict conditional access policies in Microsoft 365 to limit access based on risk factors and device compliance.

Summary

The Tykit phishing kit represents a sophisticated credential theft campaign targeting Microsoft 365 users across multiple industries worldwide, including Europe. It leverages SVG files as an unconventional delivery vector to bypass traditional email and web filters. Upon user interaction, Tykit initiates a multi-stage attack chain that executes client-side code in several phases, effectively mimicking legitimate Microsoft login pages to harvest credentials. To evade detection and automated analysis, the kit integrates Cloudflare Turnstile, a CAPTCHA-like anti-bot service, and implements basic anti-debugging techniques. The exfiltration of stolen credentials occurs through a series of API calls to command and control servers hosted on domains such as segy.cc and variants, as well as obfuscated subdomains mimicking Microsoft login URLs. The campaign has been active since May 2025 and affects sectors including finance, construction, IT, professional services, government, and telecom. The use of multi-stage execution and evasion tactics increases the difficulty of detection by conventional security solutions. While no known exploits or CVEs are associated with Tykit, its reliance on social engineering and phishing makes user awareness critical. The absence of authentication requirements lowers the barrier for attackers, but user interaction remains necessary for successful compromise.

Indicators of compromise

Domains 6

segy.cc
segy.shop
segy.xyz
segy2.cc
loginmicr0sft0nlineeckaf.52632651246148569845521065.cc
o3loginrnicrosoftlogcu02re.1uypagr.com

Hashes 2

a7184bef39523bef32683ef7af440a5b2235e83e7fb83c6b7ee5f08286731892
ecd3c834148d12af878fd1decd27bbbe2b532b5b48787bad1bde7497f98c2cc8

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Oct 2025, 08:07 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 6

Hashes 2

Community reviews

Related threats