alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Tycoon2FA Phish Landing Page 2025-07-14"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"|3c|title|3e e2 80 8b 3c 2f|title|3e|"; fast_pattern; reference:url,t7f4e9n3.delivery.rocketcdn.me/wp-content/uploads/2025/06/Sekoia_io___Global_analysis_of_Adversary_in_the_Middle_phishing_threats.pdf; reference:url,trustwave.com/en-us/resources/blogs/spiderlabs-blog/tycoon2fa-new-evasion-technique-for-2025/; reference:url,urlscan.io/result/0195c73f-bfd0-7000-8386-94b11ace6088/dom/; classtype:social-engineering; sid:2063446; rev:3; metadata:attack_target Client_Endpoint, created_at 2025_07_14, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Critical, tag Phishing, tag Tycoon2FA, updated_at 2026_01_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)