Tycoon Operator Revokes or Replaces Existing Sessions

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•3•0•10

Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.