Tycoon2FA - CAPTCHA Bypass Redirect (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•3

Detects browser network events accessing Cloudflare Turnstile endpoints followed immediately by a connection to an anomalous, newly registered AiTM subdomain. This sequence of events is indicative of a CAPTCHA bypass technique used by the Tycoon2FA phishing kit.