Loading malware…
Tycoon2FA is a commercial phishing-as-a-service platform first observed in August 2023. Its developer and operator are tracked by Microsoft as Storm-1747. Sold through Telegram and Signal, the platform supplies campaign-management dashboards, impersonated sign-in pages, lure-generation tools, redirect configuration, and access to captured credentials and session cookies. It targets cloud identities, particularly Microsoft 365 and Google accounts, across sectors including education, healthcare, finance, government, nonprofits, and legal services.
Tycoon2FA primarily uses adversary-in-the-middle phishing to relay authentication between victims and legitimate services. It captures passwords and session cookies while forwarding multifactor authentication challenges and responses, allowing attackers to reuse authenticated sessions without independently satisfying MFA. Compromised sessions can remain usable after password changes unless the relevant sessions and tokens are revoked. Updated versions also support Microsoft 365 device-code phishing, persuading victims to authorize attacker-initiated authentication on legitimate Microsoft pages and thereby issue OAuth tokens to the attacker.
Campaigns commonly distribute phishing emails containing links or HTML, SVG, PDF, and Word attachments, including QR-code lures. Shared-document, voicemail, payroll, and other business themes direct victims through multistage redirects to authentication lures. Evasion mechanisms include browser fingerprinting, anti-bot screening, custom CAPTCHAs, JavaScript obfuscation, dynamic decoy pages, automated-analysis detection, and rapidly rotating infrastructure. Captured credentials and session tokens can be forwarded through Telegram bots.
Microsoft, Europol, and industry partners coordinated a disruption of Tycoon2FA in March 2026. Subsequent activity demonstrated continued operation, including rebuilt infrastructure and device-code phishing capabilities.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The researchers also found similarities between the campaign's first-stage JavaScript and Tycoon2FA device code harvesting activity.
Until a major global takedown, the most successful commercial kit for running this exact con was called Tycoon2FA. Its entire reason for existence is simple: to systematically defeat the one security defense we have spent a decade promoting as a silver bullet, multi-factor authentication.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens...”
Post-disruption campaigns also used URL shortener services, links inside legitimate presentation platforms, and compromised SharePoint environments from trusted contacts to redirect targets toward Tycoon2FA infrastructure.
The campaigns used fake accounts impersonating senior executives to send document-sharing notifications from legitimate Notion infrastructure. | A financially motivated threat actor has been observed abusing free Notion accounts, malicious PDFs and device code phishing to harvest authentication tokens from targeted organizations.
Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering, QR codes, malicious attachments, and multistage redirects to evade detection.
The kits reproduced login pages for banks and other trusted institutions closely enough to fool victims, then distributed links to those pages through email, SMS, and WhatsApp.
Threat actors use CAPTCHA pages to delay detection and increase user interaction... By forcing users to engage with the CAPTCHA before accessing the payload, threat actors reduce the likelihood of automated scanning tools identifying the threat and increase the chances of successful credential harvesting or malware delivery.
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens...”
“Attackers could then access sensitive data and establish persistence by… registering new authenticator apps…”
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens...”
It evades detection using real-time anti-bot screening, browser fingerprinting, self-hosted CAPTCHAs, heavy JavaScript obfuscation, and dynamic decoy pages.
The group behind the PhaaS platform... sells phishing kits that impersonate various enterprise application sign-in pages... Once the CAPTCHA had been successfully completed, the user would then be shown a fake sign-in page used to compromise their account credentials.
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens...”
Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.
“Attackers could then access sensitive data and establish persistence by… registering new authenticator apps…”
“Validating and filtering incoming traffic… Suspicious user agent profiling… When the campaign infrastructure encountered an unexpected or invalid server response (for example, a geolocation outside the allowed targeting zone), the kit replaced phishing content with a decoy page…”
Once the user completed the fake check, they were redirected to a spoofed sign-in page designed to steal their account credentials.
The fetched content is generally a credential-harvesting page impersonating a widely used login such as Microsoft 365, Google Workspace or Adobe.
[AiTM portals] capture the resulting session token, and thereby defeat multifactor authentication.
“whoever initiates the authentication request receives the resulting tokens. Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities...”
[AiTM portals] capture the resulting session token.
“Attackers could then access sensitive data and establish persistence by… registering new authenticator apps…”
Increasingly these pages are not simple clones but adversary-in-the-middle (AiTM) portals: they relay what the victim types to the real login service in real time.
The victim is then prompted to enter a device code, completing multi-factor authentication and issuing OAuth tokens to the attacker.
AiTM attacks proxy the authentication process, so a user who enters credentials correctly and completes an MFA challenge still hands the attacker a valid session cookie.
Its operators used rotating domains, CAPTCHA challenges, browser fingerprinting, traffic filtering... to evade detection.
"Tycoon2FA’s suite also included tools that allowed attackers to steal session cookies, and bypass two-factor and multi-factor authentication."
Once the user completed the fake check, they were redirected to a spoofed sign-in page designed to steal their account credentials.
The fetched content is generally a credential-harvesting page impersonating a widely used login such as Microsoft 365, Google Workspace or Adobe.
“Attackers could then… establish persistence by modifying mailbox rules… Remove malicious inbox rules – Attackers often create inbox rules to hide their activity or forward sensitive data.”
Capturing authenticated session material can provide account access even after a victim completes a conventional MFA challenge.
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”
Increasingly these pages are not simple clones but adversary-in-the-middle (AiTM) portals: they relay what the victim types to the real login service in real time.
Tycoon2FA is a highly sophisticated reverse-proxy AiTM kit designed specifically to slip past standard security defenses through a multi-layered evasion strategy.
Stolen data was automatically forwarded straight to a Telegram bot, giving attackers immediate, real-time access to the compromised accounts.
“Captured session information… are exfiltrated through Telegram bot… Captured credentials and session tokens were exfiltrated… often via Telegram bots.”
“it chained multiple intermediate hosts, such as Azure Blob Storage, Firebase, Wix, TikTok, or Google resources… combined these redirect chains with encoded URI strings that obscured full URL paths and landing points…”
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.