Tycoon 2FA

Tycoon 2FA is a large phishing-as-a-service operation and toolkit active since 2023 that became one of the most prolific platforms for adversary-in-the-middle phishing against cloud identities, especially Microsoft 365 and also Gmail. It is widely tracked as a financially motivated cybercriminal service and has also been referred to as Storm-1747 in Microsoft reporting. The platform is sold to affiliates through a subscription model and has been used in high-volume credential-harvesting campaigns that bypass multifactor authentication by relaying live authentication sessions and stealing session cookies and authentication tokens. Tycoon 2FA emerged from earlier large-scale phishing-kit activity and evolved into a mature ecosystem with operators and affiliates. Its campaigns commonly use business-themed lures such as voicemail, payment, document-signature, payroll, and policy notifications, delivered through links, PDFs, QR codes, HTML or SVG attachments, and trusted redirectors. The platform is known for CAPTCHA or Turnstile gating, anti-analysis checks, obfuscated scripts, dynamic branding of phishing pages to match the victim organization, and encrypted transmission of stolen data to backend infrastructure. It has been associated with short-lived domains, privacy-protected registrations, proxy infrastructure, and rapid rehosting after disruption. A defining capability of Tycoon 2FA has been adversary-in-the-middle phishing that captures credentials, multifactor authentication responses, and session cookies in real time, enabling account takeover without defeating MFA cryptographically. By 2025 and 2026, the operation also adopted OAuth device code phishing, abusing Microsoft’s legitimate device authorization flow to trick victims into authorizing attacker-controlled devices. In these campaigns, victims authenticate on genuine Microsoft infrastructure, but the approval grants tokens to the attacker, enabling persistent cloud access, reconnaissance, email abuse, and follow-on business email compromise or internal phishing. Post-compromise activity has included automated cloud logins, token reuse, and use of rotating proxy infrastructure. Tycoon 2FA has targeted organizations globally at very large scale, with especially strong evidence of targeting in the United States and the United Kingdom, and sectors including government, health care, financial services, education, and technology. Reporting has linked the platform to tens of millions of phishing emails per month at peak activity and to compromises affecting large numbers of organizations and users worldwide. The operation was disrupted in March 2026 through a coordinated action involving Microsoft, Europol, and partner organizations, including seizure of hundreds of domains forming core phishing and control infrastructure. Despite that disruption, operators and affiliates rapidly adapted by shifting hosting providers, domain patterns, proxy sources, and delivery mechanisms, while much of the core kit and tradecraft remained intact. Subsequent reporting indicates that Tycoon 2FA’s code, techniques, and affiliate ecosystem were redistributed across cloned deployments and competing phishing services, helping spread device code phishing and other identity-focused tradecraft more broadly across the phishing-as-a-service landscape.