AiTM Node.js User Agent Sign-In (Tycoon 2FA)

Ethan Andrews@eandrews

•updated Jun 11, 2026•21•0•33

Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.