Phishing-as-a-service (PhaaS) platforms drove a surge in phishing attacks in the first two months of 2025, according to researchers at Barracuda.
PhaaS platforms, which provide criminals with a ready-made kit for launching advanced phishing attacks, were responsible for more than a million attacks in January and February. Three PhaaS platforms accounted for nearly all of these attacks, with the Tycoon 2FA kit dominating the market.
“Tycoon 2FA was the most prominent and sophisticated PhaaS platform active in early 2025,” Barracuda says. “It accounted for 89% of the PhaaS incidents seen in January 2025. Next came EvilProxy, with a share of 8%, followed by a new contender, Sneaky 2FA with a 3% share of attacks.”
Sneaky 2FA is a new phishing platform that emerged earlier this year. The tool targets Microsoft 365 accounts and can bypass multi-factor authentication.
Barracuda explains, “Targets receive an email that contains a link. If they click on the link, it redirects them to a spoofed, malicious Microsoft login page. The attackers check to make sure the user is a legitimate target and not a security tool before pre-filling the fake phishing page with the victim’s email address by abusing Microsoft 365’s ‘autograb’ functionality.
The attack toolkit is sold as-a-service by the cybercrime outfit, Sneaky Log. It is known as Sneaky 2FA because it can bypass two factor authentication. Sneaky 2FA leverages the messaging service Telegram and operates as a bot.”
Barracuda notes that employee training can provide an important layer of defense against phishing attacks.
“Security awareness training for employees that helps them to understand the signs and behaviours of the latest threats is also important,” the researchers write. “Encourage employees to report suspicious-looking Microsoft/Google login pages. If you find them, undertake an in-depth log analysis and check for MFA anomalies.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Barracuda has the story.
Here's how it works:
