Loading malware…
Tycoon 2FA is a phishing-as-a-service adversary-in-the-middle platform first observed in August 2023 and widely tracked as one of the most prolific kits used to bypass multifactor authentication for cloud identity services. It primarily targets Microsoft 365, Microsoft Entra ID, Outlook, OneDrive, SharePoint, Gmail, and Google Workspace accounts by proxying legitimate authentication flows in real time, harvesting usernames and passwords, relaying MFA prompts, and stealing authenticated session cookies or tokens that can be replayed for account takeover. Microsoft has associated major Tycoon 2FA activity with the threat actor Storm-1747.
The platform is operated as a commercial service for affiliates and lowers the barrier to entry for large-scale phishing. It has been sold through underground channels with subscription-style access and provides campaign management features such as phishing templates, lure generation, redirect logic, victim tracking, and administrative panels. Tycoon 2FA has been used at scale against enterprises, government, healthcare, education, finance, technology, and professional-services organizations, with healthcare and education repeatedly identified among the hardest-hit sectors.
Tycoon 2FA commonly relies on phishing emails and attachment-based lures, including links or QR codes embedded in HTML, PDF, SVG, and presentation files, as well as voicemail, document-sharing, invoice, payment, password-reset, and account-security themes. In many campaigns, victims are routed through layered redirectors and fake CAPTCHA or human-verification gates before reaching a high-fidelity login page that dynamically mirrors the target organization’s branding. The kit has also been observed behind blind redirector infrastructure that conceals downstream adversary-in-the-middle destinations from email security tooling.
A defining characteristic of Tycoon 2FA is its extensive anti-analysis and defense-evasion tradecraft. Reported features include browser fingerprinting, filtering of cloud and security-vendor IP space, bot and scanner checks, anti-debugging logic, suppression of developer tools, DOM self-removal of malicious scripts, staged encrypted payload delivery, layered obfuscation, and rapid infrastructure rotation. The phishing flow can adapt based on authentication responses and organizational policy cues, improving realism and success rates.
Beyond classic reverse-proxy credential theft, Tycoon 2FA has also been observed repurposed for OAuth device-code phishing against Microsoft 365. In that variant, victims are tricked into completing a legitimate device authorization flow that grants tokens to an attacker-controlled device rather than surrendering a password directly. Reporting has also linked Microsoft-focused Tycoon 2FA activity to post-compromise persistence through rogue device registration in Entra ID to obtain primary refresh tokens, allowing access to survive ordinary session revocation in some cases.
The platform has been tied to very large phishing volumes and broad victimization worldwide. In 2026, a coordinated disruption led by Microsoft, Europol, and multiple industry partners seized hundreds of domains associated with Tycoon 2FA infrastructure, including phishing pages and control panels. Despite that action, subsequent reporting indicated that operators and affiliates adapted quickly, with cloned deployments, redistributed code, and related campaigns continuing after the takedown.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A powerful phishing kit known as Tycoon 2FA has been making waves across the cybersecurity world since it first appeared in August 2023. The kit operates as a Phishing-as-a-Service (PhaaS) platform... Its primary goal is to steal authenticated session tokens from Microsoft 365 and Google Workspace accounts by sitting silently between the victim and the real login page.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Successful device code phishing attacks can lead to full account takeover, theft of sensitive information, fraud and business email compromise, lateral movement within a compromised environment, and even disruptive attacks like ransomware.
This article will explore the Tycoon 2FA phishing kit, a sophisticated Phishing-as-a-Service (PhaaS) platform... designed to bypass two-factor authentication (2FA) and multi-factor authentication (MFA) protections, primarily targeting Microsoft 365 and Gmail accounts.
Successful device code phishing attacks can lead to full account takeover, theft of sensitive information, fraud and business email compromise, lateral movement within a compromised environment, and even disruptive attacks like ransomware.
The kit uses the urn:ms-drs:enterpriseregistration.windows.net access token to POST endpoint EnrollmentServer/device... DRS creates a device object, assigns a device ID, signs and returns a device certificate.
The initial HTML page includes a JavaScript file with a base64-encoded payload. This payload is compressed using the LZ-string algorithm... The malicious script contains three different base64-encoded payloads... This payload is obfuscated using an XOR cipher.
Primary Tactics & Techniques ... Masquerading (T1036) Look-alike domains, cloned login workflows, valid TLS certificates, and legitimate branding assets loaded from Microsoft CDNs create convincing replicas of real authentication portals.
Successful device code phishing attacks can lead to full account takeover, theft of sensitive information, fraud and business email compromise, lateral movement within a compromised environment, and even disruptive attacks like ransomware.
It filters visitors from cloud and hosting IP ranges, blocks developer tools, detects automation frameworks, and removes its own malicious code from the page after execution.
These pre-redirection checks are a key part of the phishing kit’s defense against detection... CAPTCHA check... Bot/Scanning tools check... Debugger check... If a bot is detected, it will immediately try to connect to a specific, hardcoded URI... The script first performs a user agent check to see if the browser is being controlled by an automated tool, PhantomJS or Burp Suite.
The kit is sophisticated enough to prompt users for their multi-factor authentication (MFA) code and can relay that code to Microsoft’s servers in real-time, effectively bypassing this critical security step.
Primary Tactics & Techniques ... Browser Information Discovery (T1528) Browser and environment fingerprinting (UA, screen, timezone, language) for filtering and geo-fencing.
Victims who end up interacting with a booby-trapped link embedded in the phishing email traverse through a five-stage redirect chain that implements anti-analysis protections, User-Agent fingerprinting, and a CAPTCHA gate, before taking them to the final destination, which can be either an AitM proxy or a device code endpoint.
These pre-redirection checks are a key part of the phishing kit’s defense against detection... CAPTCHA check... Bot/Scanning tools check... Debugger check... If a bot is detected, it will immediately try to connect to a specific, hardcoded URI... The script first performs a user agent check to see if the browser is being controlled by an automated tool, PhantomJS or Burp Suite.
Primary Tactics & Techniques ... Application Layer Protocol: Web (HTTPS) (T1071.001) All attacker–victim communication occurs over HTTPS, blending malicious traffic with normal web activity and reducing network-level detection.
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adversary-in-the-middle phishing kit/proxy used downstream of the Bulletproof blind redirector to hijack authenticated Microsoft sessions and bypass MFA by intercepting session tokens.
Tycoon 2FA is a phishing-as-a-service adversary-in-the-middle kit that steals authenticated session tokens from Microsoft 365 and Google Workspace users, allowing attackers to bypass MFA. It uses reverse-proxy relays, WebSocket-based session relay, and device-code-grant abuse, and can establish persistence by registering rogue devices in Entra ID to obtain primary refresh tokens.
An adversary-in-the-middle phishing kit and PhaaS platform that proxies real Microsoft 365/Entra ID and Google Workspace login flows, captures post-MFA session tokens, and enables account takeover. The Microsoft-focused variant also abuses OAuth device code flow and can register rogue devices to obtain a primary refresh token for persistence.
Tycoon 2FA is a phishing-as-a-service kit used to compromise Microsoft 365 accounts. In this campaign it was repurposed from credential-relay phishing to OAuth device-code phishing, using layered in-browser delivery, anti-analysis checks, Check Domain gating, and AES-encrypted backend coordination to obtain Microsoft-issued tokens without directly capturing passwords.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.