Tycoon2FA - Multi-App Access Post-Phish (T1539)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies a single IP address (the attacker) accessing multiple distinct enterprise applications (Exchange, SharePoint, Teams) in rapid succession using a hijacked cookie.