Tycoon Uses a One-Time Session Path for Each Victim

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•2•0•8

Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.