Tycoon2FA Node.js Polling for Microsoft Authentication Broker

Elgonad .@elgonad

•updated May 18, 2026•4•0•197

Detects anomalous Microsoft Entra ID sign-in events where the application accessed is the Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e) and the User-Agent indicates a Node.js automated backend ('node' or 'undici'). This combination strongly suggests Tycoon2FA operator polling for device-code token acquisition.