[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX8xWJcIdX71GLL8ltD-BbxNs6BizrBi6VJvfFcRlFYs":3},{"article":4,"iocs":36,"watch_terms":37,"solutions":38,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c998512b-e6ad-4398-9fd2-2f29786b5283","Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing","tycoon-2fa-phishers-scatter-adopt-device-code-phishing-3458ed","In embracing device code phishing, attackers trick victims into handing over account access by using a service's legitimate new-device login flow.","The Tycoon 2FA phishing group has evolved its attack methodology, moving away from traditional two-factor authentication bypass techniques to exploit legitimate device code authentication flows. By deceiving victims into authorizing device login attempts, attackers gain account access without needing to compromise passwords or bypass 2FA directly. This represents a significant tactical shift in how the group operates.","Tycoon 2FA phishing group shifts to device code phishing attacks.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Ftycoon-2fa-hackers-device-code-phishing","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt70085bc1304b3cb3\u002F69e2855c41f7f85ddb368bc3\u002FQR_code-Harry_Wedzinga-Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-04-17T19:05:51+00:00","2026-04-17T22:00:08.599597+00:00",7,[17],{"name":18,"type":19},"Tycoon 2FA","threat_actor","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":20,"icon":22,"name":23,"slug":24},null,"Identity & Access","identity-access",[26,31],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":39,"vendors":118},[40,69,92],{"slug":41,"name":42,"problem":43,"products":44},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[45,53,61],{"vendor_slug":46,"vendor_name":47,"vendor_logo":48,"product_slug":49,"product_name":50,"url":51,"description":52},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":70,"name":71,"problem":72,"products":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[74,79,87],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":75,"product_name":76,"url":77,"description":78},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":46,"vendor_name":47,"vendor_logo":48,"product_slug":88,"product_name":89,"url":90,"description":91},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":93,"name":94,"problem":95,"products":96},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[97,104,112],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":93,"product_name":101,"url":102,"description":103},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":129},"device-code-phishing-exploits-legitimate-authentication-flows","Device Code Phishing Exploits Legitimate Authentication Flows","The Tycoon 2FA phishing group has shifted tactics to exploit device code authentication, a legitimate Microsoft feature that allows users to sign in on devices without keyboards by entering a code on another device. Attackers trick victims into visiting malicious websites that display fake device authorization prompts, convincing users to enter the displayed code on their legitimate Microsoft accounts. This bypasses traditional 2FA protections because the authentication flow appears legitimate to both the user and Microsoft's systems. Organizations must educate users about this emerging threat and implement additional safeguards around device authorization processes.",[124,125,126,127,128],"CIS Control 6","CIS Control 14","NIST AC-2","NIST AC-19","NIST AT-2",{}]