Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
ID: 8dc2a076-e48e-5fc7-b2a9-d5b2614f4ef5
STIX ID: report--8dc2a076-e48e-5fc7-b2a9-d5b2614f4ef5
Feed Name: Elastic Security Labs
Threat Score
Tycoon 2FA is a widely used Phishing-as-a-Service AiTM platform that proxies real Microsoft and Google login flows to steal post-MFA session tokens and, in some cases, register device-based primary refresh tokens (PRTs) for persistent access; the report details variants, evasion and persistence techniques, detection rules, and mitigation guidance including blocking device-code flows and deploying phishing-resistant MFA.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.