Entra ID Sign-in via Node.js User Agent (Tycoon 2FA)

Duo Tech@duotech

•updated Jun 1, 2026•5•0•36

Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.