[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI-zN8KpuT1US2k4r5AbI0TxAHpXDZZTCnjz_FQRd5YE":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"7c6d9952-6d10-4b71-95cf-90914a10affd","Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing","tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing-446b21","The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. [...]","The Tycoon2FA phishing-as-a-service platform, recently disrupted by law enforcement in March 2026, has rebuilt operations and now supports device-code phishing attacks against Microsoft 365 accounts. The kit abuses legitimate Trustifi click-tracking URLs to redirect victims through multiple obfuscation layers, ultimately tricking them into authorizing attacker-controlled devices via OAuth 2.0 device authorization flows. Device-code phishing attacks have surged 37x this year across at least ten PhaaS platforms, with Tycoon2FA adding advanced anti-analysis protections including 230+ vendor blocklists and debugger timing traps.","Tycoon2FA phishing kit adds device-code attacks to hijack Microsoft 365 accounts via Trustifi URLs.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ftycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F15\u002FMS365.jpg","2026-05-17T14:43:10+00:00","2026-05-17T16:00:08.423349+00:00",9,[17,20,22,24,27],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"Trustifi",{"name":23,"type":19},"Abnormal Security",{"name":25,"type":26},"Microsoft 365","product",{"name":28,"type":29},"OAuth 2.0","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,54],{"type":34,"value":48,"context":49},"Tycoon2FA","Phishing-as-a-service kit targeting Microsoft 365 accounts via device-code phishing and OAuth hijacking",{"type":51,"value":52,"context":53},"mitre_attack","T1566.002","Phishing: Spearphishing Link – Trustifi URL-based credential theft",{"type":51,"value":55,"context":56},"T1528","Steal Application Access Token – OAuth device code flow exploitation",[18,21,23],{"controls":59,"vendors":140},[60,88,114],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":82,"vendor_name":18,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":89,"name":90,"problem":91,"products":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":82,"vendor_name":18,"vendor_logo":83,"product_slug":110,"product_name":111,"url":112,"description":113},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,132],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":82,"vendor_name":18,"vendor_logo":83,"product_slug":128,"product_name":129,"url":130,"description":131},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[141,144],{"slug":133,"name":134,"logo_path":135,"roles":142},[143],"reported_by",{"slug":82,"name":18,"logo_path":83,"roles":145},[146],"affected"]