Tycoon 2FA AiTM: The Phishing‑as‑a‑Service Threat That Bypasses MFA on Entra ID & Google Workspace

Tycoon 2FA has cemented itself as the most prolific Phishing‑as‑a‑Service (PhaaS) platform for AI‑driven “Adversary‑in‑the‑Middle” (AiTM) attacks. First spotted in August 2023 and linked to the Storm‑1747 threat actor, the kit delivers turnkey MFA bypass capabilities that harvest authenticated session tokens from Microsoft 365 and Google Workspace accounts.

How the Kit Operates

• Victims receive a phishing email with a link or QR code embedded in a PDF, SVG, HTML, or PPTX attachment.
• The link routes through a multi‑layer redirect chain that performs browser fingerprinting, CAPTCHA challenges, and anti‑analysis checks.
• Users see a pixel‑perfect replica of the Microsoft or Google login page, often with the target organization’s branding dynamically fetched.
• Credentials are relayed in real time to the legitimate identity provider; the real MFA challenge is proxied back to the victim.
• After the victim completes MFA, the identity provider issues a session token. The proxy intercepts this token before it reaches the browser, giving the attacker a fully authenticated access token.

Current Variants in Play

• WebSocket AiTM (Classic Flow) – The proxy forwards traffic to Microsoft or Google over WebSocket (Socket.IO) and captures the post‑MFA session cookie.
• Device‑Code‑Grant Abuse (Microsoft Only) – The kit obtains a device code from Microsoft’s OAuth device‑code endpoint, displays it to the victim as a “verification code,” and exchanges it for access/refresh tokens after the victim logs in at the official Microsoft devicelogin endpoint.

Evasion Tactics

• IP‑based researcher filtering: visitors from cloud/hosting providers (Leaseweb, DigitalOcean, AWS, Cloudflare, etc.) are redirected to a decoy site.
• Bot and tool detection: checks for Selenium, PhantomJS, and Burp in the user‑agent, redirecting suspicious users to about:blank.
• Developer‑tool blocking: intercepts F12, Ctrl+Shift+I/J/C, and right‑click context menus to thwart debugging.
• Debugger trap: uses JavaScript timers and exception handling to detect and disable debugging attempts.

Recent Takedown & Operator Adaptation

A coordinated takedown in March 2026, led by Microsoft and Europol with support from Cloudflare, SpyCloud, and eSentire, seized over 300 Tycoon domains. Yet operators adapted within weeks, integrating OAuth device‑code phishing flows and maintaining the kit’s position as the #1 entry on ANY.RUN’s malware trends tracker.

Elastic’s Response

Elastic has mapped telemetry fingerprints across Entra ID and Google Workspace, shipping detection rules for both tiers. With Elastic Workflows, incidents can now be contained in under ten seconds, effectively neutralizing the token‑capture window that Tycoon exploits.