Tycoon 2FA AiTM Token Replay Against Microsoft 365 - Payroll Pirate

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects Adversary-in-the-Middle (AiTM) session hijacking against Microsoft 365, specifically targeting the Tycoon 2FA phishing kit (associated with campaigns like Payroll Pirate). It correlates two distinct malicious behaviors: the initial MFA capture phase (involving specific error codes and spoofed user agents) and subsequent illicit token replay against the Microsoft Graph API from unmanaged devices.