Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
Tycoon2FA phishing kit adds device-code attacks to hijack Microsoft 365 accounts via Trustifi URLs.
The Tycoon2FA phishing-as-a-service platform, recently disrupted by law enforcement in March 2026, has rebuilt operations and now supports device-code phishing attacks against Microsoft 365 accounts. The kit abuses legitimate Trustifi click-tracking URLs to redirect victims through multiple obfuscation layers, ultimately tricking them into authorizing attacker-controlled devices via OAuth 2.0 device authorization flows. Device-code phishing attacks have surged 37x this year across at least ten PhaaS platforms, with Tycoon2FA adding advanced anti-analysis protections including 230+ vendor blocklists and debugger timing traps.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Tycoon2FA
- mitre_attack — T1566.002
- mitre_attack — T1528