Tycoon2FA Check Domain Infrastructure Detection

Lacey Cochrane@NullVectorX

•updated May 17, 2026•3•0•294

This rule detects DNS queries to known malicious domains associated with the Tycoon2FA phishing campaign. These domains are used for anti-bot verification during the attack chain, which typically involves hijacking Microsoft 365 accounts via device code phishing.