Tycoon2FA - Post-Compromise MFA Registration (T1098.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.