Payroll Pirate: AiTM Tycoon 2FA MFA Bypass via Session Token Capture

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•4

Detects signs of Adversary-in-the-Middle (AiTM) phishing where a login attempt produces a reprocess error (50199) or result code 90014, immediately followed by suspicious activity using specific Firefox user-agent versions known to be associated with Tycoon 2FA reverse proxy session token capture tools.