Executive Summary
Tycoon 2FA is a prolific Phishing-as-a-Service (PhaaS) platform attributed to Storm-1747 that enables Adversary-in-the-Middle (AiTM) attacks to bypass multi-factor authentication (MFA). Despite a major global takedown in March 2026, the kit has adapted by incorporating OAuth Device Code phishing and complex evasion techniques to steal authenticated session tokens from Entra ID and Google Workspace environments.
The attack chain involves sophisticated multi-layer redirects, browser fingerprinting, and pixel-perfect replicas of login pages that proxy real-time MFA challenges. In Microsoft environments, the threat is particularly dangerous due to its ability to register rogue devices and mint Primary Refresh Tokens (PRT), allowing attackers to maintain access even after standard session revocation and password resets.
Organizations are at high risk as standard Entra ID risk signals often fail to flag the kit's rotating VPS-based infrastructure. Successful compromise typically results in rapid automated reconnaissance of the Graph API, targeting directory roles, mailbox settings, and contact lists within minutes of token acquisition.