Tycoon 2FA is a prolific AiTM Phishing-as-a-Service kit attributed to Storm-1747 that steals Microsoft 365 and Google Workspace session tokens, and it remains active despite a March 2026 takedown because operators quickly adapted with new relays and OAuth Device Code phishing. The article details its anti-analysis, device-code abuse, device-PRT persistence, post-compromise Graph reconnaissance, Google Workspace relay behavior, and defensive detections and workflows. #Tycoon2FA #Storm1747 #Microsoft365 #GoogleWorkspace #MicrosoftEntraID #MicrosoftGraph #OAuthDeviceCode #Cloudflare #Europol
Keypoints
- Tycoon 2FA is a large-scale AiTM PhaaS platform first observed in August 2023 and attributed to Storm-1747.
- The kit bypasses MFA by proxying logins in real time and stealing session cookies/tokens from Microsoft 365 and Google Workspace.
- At its peak, Tycoon 2FA accounted for about 62% of phishing attempts blocked by Microsoft and targeted more than 500,000 organizations per month.
- Microsoft, Europol, Cloudflare, SpyCloud, eSentire, and others disrupted the infrastructure in March 2026 by seizing over 300 domains, but operators resumed activity within weeks.
- Current tradecraft includes OAuth Device Code phishing, device-registration persistence, and aggressive anti-analysis checks such as IP filtering, bot detection, DevTools blocking, and per-victim encryption.
- Microsoft-side operations use a two-tier model: a cloud-hosted kit relay for token theft and a separate residential-shaped operator console for Graph API reconnaissance.
- Google Workspace campaigns are single-tier relays that compress login, second-factor, token authorization, and device registration into roughly one second, creating a strong automation signal.
MITRE Techniques
- [T1566.002 ] Phishing: Spearphishing Link – Victims receive emails with links or QR codes embedded in PDF, SVG, HTML, or PPTX attachments that lead to the fake login flow. (‘The victim receives a phishing email containing a link or QR code embedded in a PDF, SVG, HTML, or PPTX attachment.’)
- [T1539 ] Steal Web Session Cookie – The AiTM proxy intercepts authenticated session tokens/cookies after MFA is completed. (‘The proxy intercepts this token before it reaches the victim’s browser.’)
- [T1078.004 ] Valid Accounts: Cloud Accounts – Stolen tokens are replayed to access Microsoft 365 and Google Workspace as authenticated users. (‘The attacker now holds a fully authenticated access token.’)
- [T1098.005 ] Account Manipulation: Device Registration – The kit registers a device to establish persistence via device-bound PRT access. (‘DRS creates a device object, assigns a device ID, signs and returns a device certificate.’)
- [T1550.001 ] Use Alternate Authentication Material: Application Access Token – The kit exchanges token material across the Auth Broker/DRS flow to mint new access and refresh tokens. (‘The kit uses this to POST… and returns the PRT plus a session key encrypted (JWE).’)
- [T1087.004 ] Account Discovery: Cloud Account – Post-compromise Graph API calls enumerate user profile, contacts, mailbox settings, and roles. (‘Check what Entra ID roles the compromised identity holds’)
- [T1069.003 ] Permission Groups Discovery: Cloud – The operator enumerates directory roles and membership data to understand privileges. (‘transitiveRoleAssignments, memberOf/directoryRole, roleManagement/directory/roleAssignments’)
- [T1526 ] Cloud Service Discovery – The operator maps tenant licensing, org structure, and app inventory. (‘subscribedSkus, organization, appRoleAssignedResources’)
Indicators of Compromise
- [Domains/Hosts ] phishing and relay infrastructure – storage.googleapis.com, sites.google.com, and api.ipapi.is
- [Client IDs / App IDs ] OAuth and device-code activity – 29d9ed98-a469-4536-ade2-f981bc1d605e, 77185425430.apps.googleusercontent.com
- [File/Attachment Types ] initial lure delivery – PDF, SVG, HTML, PPTX attachments
- [User Agents ] kit relay and automation – node, axios/1.15.2, node-fetch/1.0, undici
- [URLs / Endpoints ] Microsoft and Google auth flows – oauth2/devicecode, microsoft.com/devicelogin, login.microsoftonline.com/common/oauth2/token, EnrollmentServer/device
- [JavaScript/Event Names ] kit fingerprints – send_to_browser, response_from_browser, recieveid
- [Hashes / Keys ] embedded crypto artifact – hardcoded key 1234567890123456
Read more: https://www.elastic.co/security-labs/tycoon-2fa-aitm-detection-engineering