Tycoon 2FA phishing actors scatter, branch into new attacks | Threat Intelligence

Tycoon 2FA was a widely observed phishing kit that operated as an attacker-in-the-middle proxy, relaying user credentials and capturing session tokens to replay sessions and bypass multi-factor authentication; telemetry shows thousands of phishing attempts against federated Microsoft/Okta customers in 2025–2026 with a takedown in March 2026 and subsequent detections.