Latest

In recent investigations into advanced phishing techniques, we analysed current PaaS portals and discovered new tactics employed by what appears to be an updated iteration of previously reported PaaS platforms, tentatively named RaccoonO365. Recent activity observed on Telegram coincided with the rollout of anti-bot measures, indicating ongoing enhancements in defense evasion strategies.

Noticed during testing Phising portals that sign-ins to my account were from single-factor-authentication, even though MFA was set-up through security defaults.

Tycoon PAAS has upgraded to RaccoonO365, with these portals being active again we will explore the similarities and any changes.

We explore previously reported x11 linux user agent strings in Azure Account Compromises, with distinct connections to Tycoon PAAS