Executive Summary
Tycoon 2FA is a prolific Phishing-as-a-Service (PhaaS) platform attributed to Storm-1747 that specializes in Adversary-in-the-Middle (AiTM) attacks. Despite a significant global takedown in March 2026, the kit has evolved to incorporate OAuth Device Code phishing flows. At its peak, it targeted over 500,000 organizations monthly, using real-time proxies to capture authenticated session tokens and bypass MFA for Microsoft and Google identity providers.
Technically, the threat operates across two tiers: a cloud-VPS kit relay for token acquisition and a residential-proxy operator console for post-compromise reconnaissance. A critical risk is the kit's ability to register rogue devices in Entra ID, generating a Primary Refresh Token (PRT) that survives standard session revocation and password resets. For Google Workspace, the kit leverages specialized WebSocket communication and captures nearly every 2FA method available, including backup codes and security keys.
This threat is high-priority for any organization using cloud identity services. The rapid transition from initial phishing to automated Graph API reconnaissance (often within 10-20 minutes) requires automated containment strategies, as manual response times are typically insufficient to prevent data exfiltration.