alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Tycoon2FA Phish Redirected Decoy Page 2025-07-14, Portfolio Agency"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"<script>"; distance:0; content:"atob("; distance:0; content:"8dGl0bGU+UG9ydGZvbGlvICYgQWdlbmN5IC0gTW9kZXJuIERlc2lnbjwvdGl0bGU+"; distance:0; fast_pattern; content:"document.write("; distance:0; content:"document.currentScript"; distance:0; content:".parentNode.removeChild("; distance:0; content:"</script>"; distance:0; reference:url,t7f4e9n3.delivery.rocketcdn.me/wp-content/uploads/2025/06/Sekoia_io___Global_analysis_of_Adversary_in_the_Middle_phishing_threats.pdf; reference:url,trustwave.com/en-us/resources/blogs/spiderlabs-blog/tycoon2fa-new-evasion-technique-for-2025/; reference:url,urlscan.io/result/0195d202-70b7-799b-9c81-a57224c2c65d/#transactions; classtype:social-engineering; sid:2063448; rev:2; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_07_14, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Critical, tag Phishing, tag Tycoon2FA, updated_at 2026_01_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)