Tycoon 2FA AiTM Kit Bypasses MFA for Entra ID, Google Workspace

Key Takeaways

• The Tycoon 2FA AiTM Kit actively bypasses multi-factor authentication (MFA) on Microsoft Entra ID and Google Workspace by stealing session tokens.
• This advanced phishing kit employs two primary attack vectors: WebSocket-based session relay and abuse of the OAuth device code grant flow.
• Even after a major takedown effort in March 2026, the kit’s operators quickly adapted, demonstrating significant resilience and sophistication.
• Traditional MFA methods are insufficient; organizations must implement phishing-resistant MFA like FIDO2 security keys or passkeys to mitigate this threat.

Elastic Security Labs has released a comprehensive analysis detailing the operational mechanisms of the Tycoon 2FA Adversary-in-the-Middle (AiTM) Kit. Their research, shared in a report, illuminates the kit’s sophisticated tactics, which include exploiting WebSocket-based session relays and the device code grant flow to compromise cloud identity platforms. This analysis underscores the pervasive nature of this threat within the contemporary phishing landscape.

Despite a coordinated international effort in March 2026, led by Microsoft and Europol, which resulted in the seizure of over 300 malicious domains, the Tycoon 2FA campaign quickly resurfaced. Within weeks, its operators rebuilt their infrastructure and integrated OAuth Device Code phishing techniques, as documented by eSentire in late April 2026. This rapid recovery highlights the professional and well-resourced nature of the group behind the kit.

The sheer scale and technical sophistication of Tycoon 2FA position it as one of the most critical phishing threats currently active. Organizations relying solely on conventional MFA solutions remain vulnerable, as the kit effectively circumvents these controls through session token theft. A thorough understanding of the kit’s operational methodology is essential for developing robust defensive strategies.

How Tycoon 2FA Bypasses MFA

The Tycoon 2FA kit deviates from traditional credential theft methods. Instead, it functions as a real-time reverse proxy, positioning itself between the victim and legitimate login portals for Microsoft or Google. This allows it to intercept and relay all communication.

Victims proceed through their standard MFA challenges, entirely unaware that the kit has captured their session token the instant it was issued. The attack typically commences with a phishing email containing a malicious link or QR code embedded within various file types, such as PDFs, SVGs, HTML documents, or PowerPoint presentations.

The malicious link directs victims through a multi-layered redirection chain before ultimately landing on a pixel-perfect replica of the target login page. This fake page often dynamically incorporates the victim’s organization’s branding, directly sourced from the legitimate service. Once the victim successfully completes the MFA process, the kit intercepts the valid session cookie, granting the attacker seamless access to the account without requiring further authentication.

Evasion and Post-Compromise Persistence

The Tycoon 2FA kit is engineered for resilience against incident response procedures. It possesses the capability to register a rogue device within Entra ID, thereby acquiring a primary refresh token (PRT). This PRT remains valid even if a defender revokes all compromised user sessions, rendering the conventional “revoke sessions and reset password” remediation insufficient for complete containment.

Beyond establishing persistence, the kit employs advanced evasion techniques to thwart analysis. It actively filters out traffic originating from cloud and hosting IP ranges, blocks developer tools, detects automation frameworks, and removes its own malicious code from the webpage after execution. Furthermore, each victim receives a uniquely encrypted payload, seeded with session-specific values, making signature-based detection exceedingly difficult.

What You Should Do

• Implement Phishing-Resistant MFA: Deploy strong, phishing-resistant multi-factor authentication methods such as FIDO2 security keys or passkeys, as these are immune to AiTM session token theft.
• Enforce Device Compliance: Utilize Conditional Access policies to enforce device compliance, ensuring only trusted and compliant devices can access corporate resources.
• Block Device Code Flows: Restrict OAuth device code flows for all users, except for explicitly approved and tightly controlled scenarios.
• Enable Token Protection: Activate token protection mechanisms to bind authentication tokens to specific devices, enhancing security against token replay attacks.
• Comprehensive Remediation: In the event of a suspected compromise, meticulously enumerate and delete all registered devices associated with the compromised account *before* revoking user sessions to fully break the device-PRT persistence chain.

Indicators of Compromise (IoCs):-

The following indicators were documented by Elastic Security Labs in their analysis of Tycoon 2FA campaigns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.