Auth Broker Device Code Phishing (Tycoon 2FA)

Duo Tech@duotech

•updated Jun 1, 2026•4•0•19

Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.