Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing
Tycoon 2FA phishing group shifts to device code phishing attacks.
The Tycoon 2FA phishing group has evolved its attack methodology, moving away from traditional two-factor authentication bypass techniques to exploit legitimate device code authentication flows. By deceiving victims into authorizing device login attempts, attackers gain account access without needing to compromise passwords or bypass 2FA directly. This represents a significant tactical shift in how the group operates.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Tycoon 2FA phishing group has shifted tactics to exploit device code authentication, a legitimate Microsoft feature that allows users to sign in on devices without keyboards by entering a code on another device. Attackers trick victims into visiting malicious websites that display fake device authorization prompts, convincing users to enter the displayed code on their legitimate Microsoft accounts. This bypasses traditional 2FA protections because the authentication flow appears legitimate to both the user and Microsoft's systems. Organizations must educate users about this emerging threat and implement additional safeguards around device authorization processes.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.