Tykit Phishing: SVG Malware Used to Steal Microsoft 365 Credentials
A multi-stage phishing campaign known as Tykit has been targeting Microsoft 365 corporate users, actively employed to steal login credentials. Researchers at ANY.RUN have observed a surge in its activity since May 2025, reaching its peak in the autumn months. In several instances, the campaign led to hundreds of compromised accounts, predominantly within the financial sector.
The defining feature of the attack lies in the use of SVG files containing JavaScript code, which employs XOR obfuscation to conceal the malicious payload and redirect victims to fraudulent Microsoft login pages. These elements were consistently identified across all analyzed samples, with the associated servers sharing similar domain patterns and uniform client-side logic structures.
The counterfeit login pages perfectly mimic the Microsoft 365 interface and are hosted on auto-generated domains featuring a parameter such as “/?s=,” which contains the victim’s email address encoded in Base64. Communication with the attackers’ command-and-control servers occurs in several stages: the system first verifies the entered email address, then displays a password prompt, and finally exfiltrates the stolen credentials. The malicious scripts include anti-debugging mechanisms, such as disabling DevTools and context menus, as well as a Cloudflare Turnstile CAPTCHA to deter automated analysis.
Data capture is executed through JSON requests sent to endpoints such as “/api/validate” and “/api/login.” The first validates the entered email address, while the second transmits the captured username and password. The server then controls page behavior—displaying an error message, simulating a second login attempt, or redirecting the user to the legitimate Microsoft site to conceal traces of the intrusion. Additional logic enables debug data transmission via “/x.php” under certain conditions.
The campaign’s primary targets include organizations across the United States, Canada, Europe, Latin America, Southeast Asia, and the Middle East, spanning industries such as construction, consulting, IT, telecommunications, education, public administration, and retail. The employed attack chain can bypass multi-factor authentication by intercepting tokens, allowing adversaries to maintain persistence and move laterally within compromised networks.
Infrastructure components linked to Tykit strongly suggest a Phishing-as-a-Service (PhaaS) model—featuring segregated delivery and data collection servers, as well as license-like authentication keys used by affiliated operators.
ANY.RUN’s analysis identified several indicators of compromise, including distinct SVG signatures, JavaScript functions such as eval() and parseInt(), and repeated variable and logic patterns. The team developed detection rules capable of identifying Tykit activity both in file artifacts and network traffic, with special attention to domains beginning with “segy,” following patterns like “loginmicr(o|0)s…cc,” and requests containing the “/?s=” parameter.
To mitigate such threats, experts recommend inspecting the contents of SVG files, sandboxing suspicious attachments, adopting phishing-resistant authentication methods, and monitoring anomalous network requests. Raising employee awareness and deploying automated analysis tools are also crucial for reducing incident response time and minimizing the window of exposure.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
