Tycoon Google Session Appears after OAuth Challenge Completion

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•7

Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.