Full Report
The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. [...]
Analysis Summary
# Tool/Technique: Tycoon2FA (Device-Code Variant)
## Overview
Tycoon2FA is a sophisticated Phishing-as-a-Service (PhaaS) platform that has recently evolved from credential relay (Adversary-in-the-Middle) to supporting **OAuth 2.0 device authorization grant flow** attacks (Device-Code Phishing). Its primary purpose is to bypass Multi-Factor Authentication (MFA) to hijack Microsoft 365 accounts by tricking users into registering attacker-controlled devices.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Malware Framework
- **Platform:** Web-based (Targeting Microsoft 365 / Entra ID)
- **Capabilities:** MFA bypass, Device-code relay, anti-analysis/anti-bot protection, legitimate service abuse (Trustifi/Cloudflare).
- **First Seen:** Original variants spotted mid-2023; Device-code variant documented April/May 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Malicious Links]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1528 - Steal Application Access Token]
- **[TA0003 - Persistence]**
- [T1505 - Server Software Component] (Rogue device registration)
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts] (Obfuscated JavaScript)
- [T1497 - Virtualization/Sandbox Evasion] (Detection of Selenium, Puppeteer, etc.)
## Functionality
### Core Capabilities
- **OAuth Device-Code Relay:** Initiates a device authorization request to Microsoft and presents the generated code to the victim via a fake landing page.
- **MFA Bypass:** Leverages the legitimate `microsoft[.]com/devicelogin` flow; once the victim enters the code and completes MFA, the attacker receives OAuth access and refresh tokens.
- **Trustifi Abuse:** Uses legitimate Trustifi click-tracking URLs in lure emails to bypass email filters and increase perceived legitimacy.
### Advanced Features
- **Sophisticated Obfuscation:** Employs multiple layers of JavaScript obfuscation and Cloudflare Workers for delivery.
- **Aggressive Anti-Analysis:** Detects and blocks security tools (Burp Suite), automation frameworks (Selenium, Playwright), VPNs, sandboxes, and AI crawlers.
- **Dynamic Blocklisting:** Maintains a list of over 230 security vendor signatures and cloud providers to redirect researchers to legitimate pages.
- **Debugger Traps:** Uses timing traps to detect if a browser's developer tools or a debugger is active.
## Indicators of Compromise
*(Note: Specific hashes are often unique per campaign; behavioral indicators are more reliable for this kit.)*
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate site abused in the flow)
- Trustifi tracking domains (Abused for redirects)
- Cloudflare Worker subdomains (Used for kit delivery)
- **Behavioral Indicators:**
- **User Agents:** Presence of "Node.js" user agents in authentication logs.
- **Application ID:** Usage of "Microsoft Authentication Broker" in Entra ID/Azure AD logs for suspicious logins.
- **Auth Type:** `deviceCode` listed as the authentication method in sign-in logs for unexpected users.
## Associated Threat Actors
- Sold as a **Phishing-as-a-Service (PhaaS)**; used by multiple distinct cybercriminal affiliates rather than a single tracked group.
## Detection Methods
- **Log Analysis:** Monitor Entra ID (Azure AD) sign-in logs for the `deviceCode` authentication flow, especially if not standard within the organization.
- **User Agent Monitoring:** Alert on logins originating from non-browser user agents like `Node.js` or `Axios` attempting to access Microsoft 365 resources.
- **Network Traffic:** Identify multi-stage redirects involving Cloudflare Workers and legitimate email security platforms (Trustifi).
## Mitigation Strategies
- **Technical Policy:** Disable the OAuth device code flow if it is not a business requirement.
- **Conditional Access:** Implement Compliant Device policies or Phishing-Resistant MFA (FIDO2/Passkeys).
- **Governance:** Restrict OAuth consent permissions and require Administrator approval for third-party application integrations.
- **Continuous Access Evaluation (CAE):** Enable CAE to allow for near real-time revocation of compromised sessions.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** The predecessor technique used by Tycoon2FA and tools like **Evilproxy**.
- **Lure Platforms:** Similar to **Greatness** or **LabHost** PhaaS kits.
- **Tools:** Use of **Cloudflare Workers** for infrastructure concealment.