Tykit – New SVG Phishing Kit Steals Microsoft 365 Logins
Sensorstechforum.com investigation — A recently surfaced phishing-as-a-service (PhaaS) kit dubbed Tykit has been weaponizing SVG attachments since May 2025 to steal corporate Microsoft 365 credentials. The kit blends multi-stage redirection, heavily obfuscated JavaScript, and anti-bot checks to dodge automated scanning,…
