Multi-factor authentication became the de facto baseline security control for enterprise identity protection over the past several years, to the point where many organisations treat MFA as the answer to credential theft. Tycoon 2FA, a phishing-as-a-service platform that has been active since late 2023 and updated continuously through 2026, has built its entire business model on the premise that MFA is not an endpoint but a hurdle. The platform provides everything an attacker needs to bypass Microsoft Authenticator and Google Authenticator in real time, packaged as a subscription service with a management dashboard, pricing tiers, and customer support. As of 2026, Tycoon 2FA is one of the most widely documented MFA bypass PhaaS platforms in criminal markets, with researchers at Sekoia and later Microsoft Threat Intelligence tracking thousands of active phishing domains using its infrastructure.
Understanding how Tycoon 2FA works, how it is sold, and what its operational signatures look like is directly relevant to any organisation that has invested in MFA as a primary authentication control. The assumption that MFA stops credential phishing is correct for classical phishing attacks, those that capture a static password for later reuse. It is not correct for adversary-in-the-middle attacks of the type Tycoon 2FA automates, where the session token rather than the password is the prize and where MFA completion is part of the attack flow rather than a barrier to it.
Tycoon 2FA uses a reverse-proxy architecture in which the phishing page does not serve a static HTML form but rather forwards the victim's browser session to the real target site in real time. When the victim visits the phishing page and enters their credentials, those credentials are relayed to the real authentication endpoint. The real site responds, potentially requesting an MFA code. The phishing proxy relays that request to the victim, who enters their authenticator code. The real site validates the code and issues a session token. The proxy captures that session token before forwarding it to the victim's browser.
The result is that the victim completes a successful authentication to the real Microsoft or Google account, sees a normal post-login page, and has no direct indication that anything unusual occurred. The session token that was issued as a result of that authentication is simultaneously held by the attacker's proxy infrastructure. That token is exported and can be used to access the victim's account from any IP address for as long as it remains valid, which in the case of Microsoft 365 persistent sessions can be days or weeks.
This architecture makes Tycoon 2FA attacks categorically different from password theft phishing. The attacker does not need the victim's password and does not need to know what MFA method the organisation uses. Any MFA method that involves the user completing a challenge in the browser and receiving a session token, which covers authenticator apps, SMS codes, and push notifications that are not tied to a specific device binding, is bypassed by the real-time proxy relay. The only MFA methods that resist this attack are those that bind the authentication challenge to the specific origin domain, primarily passkeys and hardware FIDO2 keys configured with origin checking.
Tycoon 2FA is not a standalone tool that requires technical skill to deploy. It is sold as a managed service on criminal markets, with pricing tiers that range from approximately $120 per month for a basic subscription to several hundred dollars for premium tiers that include additional phishing page templates, higher throughput, and faster customer support response times. For that subscription price, the buyer gets access to a web-based control panel that manages phishing domains, monitors incoming victim sessions, and exports captured session tokens.
The phishing page templates included in the Tycoon 2FA subscription are designed to impersonate Microsoft 365 login flows with high fidelity, including the specific page sequences that Microsoft uses for different authentication scenarios, branded login pages for enterprise tenants, and MFA challenge screens that match the actual interface. The templates are updated when Microsoft changes its login interface, ensuring that the phishing pages remain visually accurate. This maintenance is the core service the PhaaS operator provides: the subscriber pays for an always-current set of phishing infrastructure without needing to update templates manually.
The subscription model means that the barrier to entry for MFA bypass phishing has dropped significantly. An attacker who wants to run an adversary-in-the-middle campaign against Microsoft 365 users does not need to understand reverse proxy architecture, does not need to write or maintain phishing page code, and does not need to handle the operational complexity of managing phishing domains. They subscribe, configure a campaign through the dashboard, distribute the phishing link through their preferred delivery channel, and collect session tokens as victims interact with the page. Sekoia's research found that Tycoon 2FA infrastructure has been used in campaigns targeting financial services, healthcare, and technology organisations specifically, with lure content tailored to each sector.
Tycoon 2FA campaigns documented in 2025 and 2026 have used several delivery mechanisms that bypass conventional email security controls. The most effective in terms of volume are document-sharing lure emails that use legitimate file-sharing services as relay points. The victim receives an email from a seemingly legitimate sender, often a compromised business email account, with a link to a shared document on OneDrive, SharePoint, or a legitimate file hosting service. That link redirects to a Tycoon 2FA phishing page. Email security tools that check links at the time of delivery see a legitimate OneDrive or SharePoint URL and do not flag it. By the time the victim clicks the link and the redirect to the phishing page occurs, the email has already passed the security filter.
A second delivery channel used in documented Tycoon 2FA campaigns is QR code embedding in PDF attachments. The PDF contains a QR code that, when scanned by a mobile device, directs the mobile browser to the phishing page. Mobile browsers generally have weaker phishing detection than desktop browsers, and the use of a QR code means that the malicious URL never appears as a clickable link in the email body where traditional URL scanning would detect it. The QR code is an image, and the scanning happens on a personal mobile device that is not subject to the organisation's email security gateway.
Voice phishing, or vishing, has been used in combination with Tycoon 2FA infrastructure in some documented campaigns: the attacker calls the target, impersonates IT support, and directs the target to a Tycoon 2FA page while keeping them on the phone to guide them through the authentication process, including the MFA challenge. This social engineering layer increases the conversion rate significantly because the attacker can handle objections in real time and reassure victims who hesitate.
Several detection signals can identify Tycoon 2FA attacks that have bypassed delivery-level controls. At the identity layer, the most reliable post-compromise signal is a successful authentication from an unusual IP address or geographic location immediately following a successful MFA challenge from a known user location. The attacker uses the captured session token from a different IP than the victim, and this token replay event appears in Azure AD sign-in logs as a new session from a new IP. Microsoft Entra ID's Conditional Access can be configured to flag or block session tokens that are used from IPs different from where they were issued, which provides a near-real-time detection capability for this specific attack pattern.
At the network layer, Tycoon 2FA phishing domains share infrastructure patterns that threat intelligence feeds track: specific autonomous systems that host Tycoon 2FA proxies, certificate patterns used for phishing domains, and URL structures characteristic of the platform's routing scheme. Organisations subscribed to threat intelligence feeds that include Tycoon 2FA indicators can block access to known domains before victims reach the phishing page.
Dark web monitoring provides pre-attack visibility: Tycoon 2FA subscriptions are advertised and discussed in criminal forums, and campaigns targeting specific organisations or sectors are sometimes announced in those channels before they launch. Monitoring for mentions of your organisation's domain or brand in PhaaS advertising and campaign coordination channels gives a window for defensive preparation before the first phishing email reaches an employee's inbox. Understanding how your organisation appears in criminal market discussions is the first step in pre-attack threat intelligence for phishing campaigns.
The existence of Tycoon 2FA and its peers does not mean that MFA is ineffective or should be abandoned. It means that specific MFA methods have specific limitations, and organisations that understand those limitations can make better decisions about which methods to deploy for which authentication contexts.
Time-based one-time passwords delivered by authenticator apps, SMS codes, and push notification approvals are all effective against password reuse attacks and traditional phishing that captures credentials for later use. They are not effective against real-time proxy attacks that relay the authentication challenge and capture the resulting session token. Hardware security keys (FIDO2) and passkeys with origin binding are effective against both categories because the cryptographic challenge is bound to the specific domain and cannot be replayed through a proxy. Microsoft's phishing-resistant MFA options, specifically the FIDO2 security key and Windows Hello for Business with hardware attestation, resist Tycoon 2FA-style attacks.
The practical recommendation emerging from the Tycoon 2FA research is not to abandon MFA but to evaluate the specific scenarios where phishing-resistant MFA is most critical. For privileged accounts, for accounts with access to financial systems, and for accounts used to access sensitive data, the upgrade from TOTP-based MFA to phishing-resistant MFA is the highest-value security control available. For the broader employee population, conditional access policies that detect anomalous session token usage provide detection capability even when phishing-resistant MFA has not been deployed at scale. Credential and session exposure monitoring is the safety net that catches what endpoint MFA controls miss.
Tycoon 2FA campaigns are not silent operations. Before a phishing campaign reaches employees' inboxes, several preparatory activities occur that are observable from the right vantage points. Phishing domains are registered, often using newly registered domains or compromised legitimate domains as laundering layers. Tycoon 2FA proxy infrastructure is provisioned and configured. In some cases, the campaign is coordinated in criminal forums or Telegram channels where the operator shares the phishing link with collaborators or sells access to a campaign targeting a specific sector.
Organisations that monitor threat intelligence feeds incorporating Tycoon 2FA indicators can receive alerts about known phishing domains before any employee visits them. Certificate Transparency monitoring can surface newly registered domains that closely match the organisation's brand within hours of registration. And dark web monitoring that covers the criminal forums and Telegram channels where Tycoon 2FA operators communicate can surface targeting discussions before the campaign is launched.
This pre-campaign intelligence window is the most valuable detection opportunity for PhaaS-based phishing because it does not require a victim to be compromised to generate a signal. Post-compromise signals, such as anomalous authentication events from unexpected IPs, only appear after at least one employee has been successfully phished. Pre-campaign monitoring produces actionable intelligence before any harm occurs.
Detecting adversary-in-the-middle phishing attacks like those enabled by Tycoon 2FA requires looking at the signals that distinguish a legitimate authentication from a proxied one. The most direct signal is the IP address from which the session token is used after authentication: if a user authenticates from an IP in London and the resulting session token is immediately used from an IP in Eastern Europe or from a residential proxy network, this anomaly is detectable in sign-in logs. Microsoft Entra ID Conditional Access policies can be configured to flag or block sign-ins from IP ranges associated with proxy services and TOR exit nodes, which are commonly used to relay captured session tokens.
Token replay detection is a more direct control. Microsoft has implemented Continuous Access Evaluation (CAE) in Entra ID, a feature that allows relying parties to be notified when a user's risk level changes or when their session should be invalidated, enabling near-real-time revocation of session tokens rather than waiting for the token's natural expiry. When CAE is enabled and the relying party supports it, a session token captured through an AiTM attack may be invalidated before the attacker can make significant use of it.
Phishing-resistant MFA, specifically hardware FIDO2 security keys and passkeys configured with origin binding, is the control that prevents Tycoon 2FA from capturing a valid session token in the first place. When origin-bound authentication is in use, the authentication response is cryptographically bound to the specific origin domain that requested it. The Tycoon 2FA proxy, operating at a different domain than the legitimate Microsoft or Google authentication endpoint, cannot produce a valid authentication response even if the user completes the authentication challenge on the proxy page. Deploying phishing-resistant MFA for the highest-value accounts, principally administrators, finance staff, and executives, materially reduces the risk surface that Tycoon 2FA campaigns can exploit.
External dark web monitoring that tracks PhaaS platform activity, including new Tycoon 2FA subscription listings, new phishing domain registrations using its infrastructure signatures, and campaign activity targeting specific industries or organisations, provides the pre-campaign intelligence that gives defenders time to heighten controls and warn users before the first phishing email is sent. The combination of technical controls and threat intelligence monitoring addresses both the active campaign and the pre-campaign intelligence phase that precedes it. Monitoring of criminal marketplaces where PhaaS tools like Tycoon 2FA are advertised and sold is the earliest warning layer available to security teams.
Threat intelligence teams tracking Tycoon 2FA have identified a consistent set of infrastructure signatures that distinguish its phishing domains from legitimate services or from other phishing kits. The phishing domains created by Tycoon 2FA subscribers tend to cluster around specific domain registration patterns: domains registered through a small set of registrars, using particular patterns of random-looking subdomains, with hosting on specific bulletproof hosting providers or on compromised hosting accounts. These infrastructure patterns allow threat intelligence analysts to identify Tycoon 2FA domains with reasonable confidence even when the phishing pages themselves are designed to look legitimate.
Microsoft Threat Intelligence published a detailed analysis of Tycoon 2FA infrastructure patterns in 2024, noting that the platform uses a Cloudflare turnstile on its landing pages specifically to filter out security scanner traffic and make the phishing pages less likely to be detected by automated tools. The use of anti-bot measures in phishing infrastructure has become standard across PhaaS platforms as operators attempt to reduce the number of their pages that end up in phishing URL blocklists. This arms race between blocklist operators and PhaaS platform operators is a structural feature of the phishing ecosystem that means no blocklist is ever complete.
For defenders, the infrastructure signatures mean that threat intelligence sharing programmes that include Tycoon 2FA infrastructure indicators can provide near-real-time blocking at the network level through DNS-based protections and firewall rules, even for phishing domains that have not yet been submitted to the major browser-based phishing lists. When a new Tycoon 2FA campaign targeting a specific sector is identified by threat intelligence researchers, sharing the associated domain list within the sector's ISAC allows organisations to block those domains before any of their users encounter a phishing email.
No. Tycoon 2FA is effective against MFA methods that complete the authentication challenge in the browser and issue a session token that can be captured by a proxy. This includes authenticator apps (TOTP codes), SMS codes, and Microsoft Authenticator push notifications. It does not work against passkeys or hardware FIDO2 security keys that use origin-bound authentication, because those methods cryptographically bind the authentication response to the specific domain that initiated it. A phishing proxy at a different domain cannot produce a valid response for an origin-bound authentication request.
Tycoon 2FA campaigns use multiple delivery channels. Email is the primary channel, with phishing emails designed to look like Microsoft security notifications, document sharing requests, or MFA re-registration requirements. QR code delivery, where the phishing URL is embedded in a QR code image rather than a plain hyperlink, is increasingly common because it bypasses email URL scanning tools that do not extract URLs from images. LinkedIn and Teams messages have also been used as delivery channels, particularly in targeted campaigns where the attacker has done prior reconnaissance on the target.
The primary indicator is a sign-in from an IP address that is inconsistent with the user's normal geographic location or access pattern, occurring at the same time as or shortly after the user completed an authentication challenge. Secondary indicators include sign-in from a new device or device type not previously associated with the user, subsequent access to specific high-value resources like email export or SharePoint, and activation of email forwarding rules to external addresses. Microsoft Entra ID risk signals flag many of these patterns automatically, but security operations teams should also review conditional access sign-in logs for anomalies specifically in the context of phishing campaign activity.
The threats described in this article, PhaaS kits sold on criminal markets, MFA bypass infrastructure sold as subscriptions, BEC campaigns sourced from infostealer logs, and AI-generated voice calls impersonating executives, all share a common thread. Their infrastructure and operational planning appear in criminal channels before they reach your organisation. Phishing kit listings, adversary-in-the-middle proxy infrastructure, voice cloning service advertisements, and targeted organisation data all circulate in forums and marketplaces that are visible to those monitoring in the right places.
Defendis monitors dark web forums, criminal marketplaces, and threat actor channels continuously for indicators related to your organisation's domains, employees, and brand. Intelligence surfaced before an attack reaches your users gives your security team time to act rather than react.
Book a demo to see how Defendis approaches phishing infrastructure monitoring and dark web threat intelligence for your organisation.
