{"success":true,"data":{"id":"tycoon-charcode-decimal-array-obfuscation","label":"Tycoon 2FA HTML obfuscation — 50+ decimal or hex-byte array fed through String.fromCharCode to decode phishing HTML at runtime","description":"HTML body or inline script contains a JavaScript array of 50+ decimal integers (or 2-digit hex bytes) fed through String.fromCharCode / fromCodePoint to reconstruct HTML at runtime — the exact obfuscation fingerprint documented in Tycoon 2FA 2025 landing pages. Bypasses Base64 scanners because the encoding is decimal, not Base64. Distinct from `mamba-tycoon-obfuscated-html-b64-blob` (which requires Blob + large Base64 string). LevelBlue SpiderLabs April 2025, Sekoia, Trustwave, Matt Ryan PhD Sep 2025, and Validin documented Tycoon 2FA blocking 10M+ attempts per month before the March 2026 takedown — successor forks expected to persist.","tier":"danger","category":"other","isThin":false}}