Tycoon 2FA phishing actors disperse, branch into new attacks | Threat Intelligence

Tycoon 2FA is a phishing kit that operates as a transparent reverse proxy to pass credentials and MFA challenges to legitimate services, capture session tokens returned to the browser, and enable session-token replay to bypass both login and MFA. Okta telemetry shows it became the most-observed AitM phishing kit by mid-2025 with thousands of detections (e.g., 11,199 detections in July 2025), a takedown on March 4, 2026, and continued detections after the takedown.