Anomalous Device Registration User Agent (Tycoon 2FA)

Ethan Andrews@eandrews

•updated Jun 11, 2026•15•0•52

Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.