Tycoon Relays Credential and MFA Forms in One Session

Ibrahim Saud@tektrix

•updated Jun 23, 2026•3•0•8

Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.