Tycoon 2FA Phishing Campaign Exploits OAuth Device Code for MFA Bypass

Key Takeaways

• The Tycoon 2FA phishing group has evolved its tactics, now leveraging OAuth Device Code phishing to compromise Microsoft 365 accounts.
• This new method allows attackers to bypass multi-factor authentication (MFA) without directly stealing user credentials.
• The campaign, identified in late April 2026, utilizes legitimate email security platforms (Trustifi) and sophisticated anti-analysis techniques to evade detection.
• Despite a major takedown in March 2026, the Tycoon 2FA kit remains largely intact, indicating resilient operations and a rapid recovery by its operators.

The operators behind the notorious Tycoon 2FA phishing-as-a-service (PhaaS) platform have unveiled a sophisticated new attack vector. They are now combining their established phishing infrastructure with an abuse of the OAuth Device Code flow, enabling them to illicitly gain access to Microsoft 365 accounts without ever needing to capture a user’s password.

Tycoon 2FA initially emerged as a significant threat, recognized for its ability to circumvent multi-factor authentication by acting as a credential relay. Over the past year, the group has consistently refined its methodologies and delivery mechanisms, striving to outmaneuver security defenses and vendor blocklists. Their operational tempo remained unbroken even after a substantial disruption in March 2026.

The Evolved Attack Chain

Analysts at eSentire reported that their Threat Response Unit (TRU) detected this campaign in late April 2026. The eSentire team discovered that the core components of the Tycoon 2FA kit persisted almost entirely unchanged following the joint takedown operation by Microsoft and Europol in March 2026. However, a critical modification involved integrating an OAuth device code flow to harvest access tokens instead of traditional credentials.

Initial Lure and Redirection

The attack commences with a highly convincing phishing email designed to lure victims. This email contains a click-tracking link originating from Trustifi, a legitimate enterprise email security platform. Importantly, Trustifi itself was not compromised; the threat actors merely exploit its trusted reputation to bypass email gateways and steer victims through a series of malicious redirects without triggering immediate security alerts.

Upon clicking the link, the victim is subjected to a multi-layered delivery chain. This chain incorporates encrypted payloads, robust anti-analysis checks, a deceptive Microsoft CAPTCHA page, and a blocklist encompassing over 230 organizations. These measures are meticulously designed to ensure that only genuine targets proceed to the final stage of the attack, effectively filtering out security researchers and automated analysis tools.

OAuth Device Code Phishing Explained

The innovative core of this campaign lies in its malicious exploitation of the OAuth 2.0 Device Authorization Grant. This protocol is a legitimate feature, primarily intended for devices such as smart TVs or IoT devices that lack conventional web browser interfaces for direct login. In a standard scenario, such a device generates a short code, and the user then enters this code on a separate, trusted website to authorize access. The Tycoon 2FA operators have ingeniously weaponized this established process.

Victims are presented with a fabricated Microsoft 365 voicemail notification. They are instructed to copy a provided user code and then navigate to the authentic Microsoft device login page, microsoft.com/devicelogin. Because the user interacts directly with genuine Microsoft infrastructure, multi-factor authentication is triggered and completed as normal. The critical deception occurs here: victims, unknowingly, are granting access tokens to an attacker-controlled device operating in the background. This technique doesn’t bypass MFA but rather manipulates what the MFA approval authorizes, redirecting the legitimate token to the attacker.

A Kit That Survived Takedown Intact

A notable aspect of eSentire’s findings is the remarkable resilience of the Tycoon 2FA kit. Despite a significant law enforcement disruption, the phishing kit’s fundamental architecture remains largely unaltered. Elements such as the same AES encryption key, the identical anti-debug timing trap, the consistent “Check Domain” grammar, and the familiar backend route patterns observed in 2025 campaigns are still present in the 2026 iteration. This continuity strongly suggests that the operators maintained backups of their codebase, enabling them to swiftly resume operations with minimal modifications.

Further post-compromise analysis of Entra sign-in logs revealed that the operators’ activities originated from Node.js automation tools, identified by the user-agent strings “node” and “undici.” These user-agents are indicative of a backend polling client and are highly unusual in typical production environments. Their appearance against the Microsoft Authentication Broker AppId should immediately raise a red flag for defenders.

The group’s operational infrastructure has also undergone a shift, moving towards Alibaba Cloud, specifically ASN AS45102. This move is part of a broader strategy of rotating hosting providers, likely in response to previous takedown pressures.

What You Should Do

• Implement Conditional Access Policies: Configure Microsoft Entra Conditional Access policies to block OAuth Device Code flows for standard end-users.
• Restrict User Consent: Enforce restrictions on user consent for OAuth applications, requiring administrative approval for all third-party application access.
• Enable Continuous Access Evaluation (CAE): Activate CAE in Microsoft Entra ID to ensure that token revocations propagate rapidly following any confirmed security incident.
• Monitor for Suspicious User-Agents: Actively hunt for “node” and “undici” user-agents in conjunction with the Microsoft Authentication Broker AppId in your Entra sign-in logs.
• Review eSentire IoCs: Leverage the specific KQL queries and URLscan patterns published by eSentire to identify related activity across your environment.
• Educate Users: Conduct regular security awareness training to educate users about sophisticated phishing tactics, especially those that mimic legitimate login processes or leverage trusted platforms.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.