In early 2025, Barracuda’s systems detected over a million attacks powered by phishing-as-a-service (PhaaS) kits like Tycoon 2FA, EvilProxy and Sneaky 2FA. These platforms excel at spoofing trusted brands and impersonating Microsoft 365 messages, making it more challenging than ever for users to spot threats.
PhaaS: Lowering the barrier for cybercrime
PhaaS lowers the barrier to entry for phishing attacks by offering criminals access to ready-made tools via subscription or one-time payments. These solutions provide phishing templates, automation, hosting, and, in some cases, even customer support.
Even scammers with minimal experience can tap into pre-made emails, fraudulent websites and customized messaging to steal money or credentials. In the early 2025 wave of attacks, Tycoon 2FA was the most prominent and sophisticated PhaaS being used, accounting for 89% of the PhaaS in January.
How AI-enhanced PhaaS makes attacks smarter and harder to detect
In addition to saving time, effort and money for criminals who want to ramp up their phishing scams quickly, PhaaS platforms (like other types of cybercrime) are being further enhanced with artificial intelligence (AI). With AI, criminals can better imitate the writing style of a legitimate sender. Because they resemble real conversations, they are harder for security systems to identify and flag as suspicious.
AI-driven phishing tools can:
- Instantly generate thousands of realistic emails from multiple “senders.”
- Use public social media data and previous breach information to personalize attacks.
- Deploy polymorphic malware that constantly changes attachment hashes and redirects URLs to evade detection.
Fighting back: Using AI-powered defenses to counter AI-driven phishing threats
The best defense against AI-powered phishing is to fight fire with fire. MSPs and their clients should deploy AI-based security solutions that adapt quickly to new threats. These advanced email security tools utilize machine learning to identify suspicious patterns, detect anomalies and continually refine their capabilities as new attack tactics emerge.
Key steps to protect your clients:
- Regular security training: Teach users to spot suspicious emails and links. For example, Tycoon 2FA attacks often use “.ru” domains or unusual URLs.
- Phishing simulations: Run regular tests to identify staff who need extra support.
- Rapid incident response: Ensure you have automated systems in place to quarantine suspicious emails and respond quickly to threats.
- Zero-trust architecture: Limit access to sensitive data and prevent unauthorized entry.
- AI-based email security: Use solutions that analyze email behavior, block social engineering attacks and automatically remove malicious messages from inboxes.
The bottom line for MSPs
The rise of PhaaS – especially when combined with AI – means attacks are now faster, more convincing and accessible to even novice cybercriminals. But AI isn’t just a weapon for attackers. By adopting AI-driven security solutions and proactive training, MSPs can help clients defend their data, protect their reputations and stay ahead of evolving threats.
MSPs shouldn’t wait for a breach to occur. It’s crucial that they assess their security stack, educate their clients and implement AI-powered defenses to protect their organization from the next wave of phishing attacks.
