Tycoon2FA - WebSocket Session Stealing

Ibrahim Saud@tektrix

•updated Jun 26, 2026•2•0•8

Detects browser network events matching Tycoon2FA WebSocket interactions used to silently stream stolen session cookies back to the AiTM proxy backend. The rule specifically looks for WebSocket connections (wss:// or ws://) with a path containing '/socket.io/?EIO=' initiated by 'chrome.exe' or 'msedge.exe'.