# Tycoon2FA Phishing Kit Returns Stronger, Now Targets Microsoft 365 via Device-Code Attacks


Cybercriminals are evolving their tactics faster than law enforcement can disrupt them. Just months after an international operation shut down the notorious Tycoon2FA phishing platform in March 2026, the threat actors rebuilt their infrastructure and launched updated campaigns—this time weaponizing OAuth 2.0 device-code phishing to compromise Microsoft 365 accounts at scale.


Security researchers at eSentire recently documented a sophisticated new variant of Tycoon2FA that chains Trustifi tracking URLs, Cloudflare Workers, and obfuscated JavaScript to trick users into authorizing attacker-controlled devices on their Microsoft 365 accounts. The attack leaves organizations exposed to complete account compromise without triggering traditional credential theft alerts.


## The Threat: Device-Code Phishing Goes Mainstream


Device-code phishing is a credential-stealing technique that exploits OAuth 2.0's legitimate device authorization flow—a feature designed to allow login on devices without web browsers (like smart TVs or IoT devices). Threat actors reverse-engineer this flow to hijack accounts.


Here's how it works in practice:


1. Initial lure: Victim receives an invoice-themed phishing email with a malicious link

2. Redirection chain: Clicking the link bounces through Trustifi (a legitimate email security tool), Cloudflare Workers, and several obfuscated JavaScript layers

3. Fake authentication: Victim lands on a spoofed Microsoft CAPTCHA page

4. The trap: Victim is instructed to copy a "verification code" and paste it at microsoft.com/devicelogin

5. OAuth approval: The victim completes their normal multi-factor authentication (MFA), unknowingly authorizing the attacker's device

6. Account takeover: Microsoft issues OAuth access and refresh tokens to the attacker-controlled device, granting full access to email, calendar, OneDrive, and more


The sophistication lies in the misdirection: victims never see a fake login form. They complete authentication on a legitimate Microsoft domain. From their perspective, they're just verifying a device—a routine security interaction they've likely performed before.


## Background and Context: From Disruption to Resilience


Tycoon2FA is a phishing-as-a-service (PhaaS) platform operated by a well-resourced threat group. In March 2026, an international law enforcement operation successfully disrupted the platform's original infrastructure. For a brief moment, defenders thought they'd scored a rare victory.


That victory lasted weeks.


By late April, the threat actors had rebuilt on new infrastructure and were back to operational capacity. Abnormal Security confirmed in mid-May that Tycoon2FA had rebounded to normal attack volumes and had added new obfuscation layers—demonstrating that this isn't a small operation that can be permanently eliminated through takedowns alone.


The timing is significant: device-code phishing has exploded in 2026.


  • Push Security reported a 37x increase in device-code phishing attacks this year
  • At least 10 distinct PhaaS platforms and private kits now support device-code attacks
  • Proofpoint documented a similar surge in its threat intelligence

    • Tycoon2FA's addition of device-code phishing to its kit confirms that the tactic has become the new standard in commercial phishing infrastructure. It's no longer an edge-case exploit—it's a mainstream attack pattern.


    ## Technical Details: The Tycoon2FA Attack Chain


    eSentire's analysis reveals a four-layer in-browser delivery mechanism that remains virtually unchanged from earlier Tycoon2FA variants. Understanding each layer is crucial for defenders.


    ### Attack Flow


    | Stage | Action | Key Component |

    |-------|--------|---|

    | 1. Delivery | Victim clicks Trustifi tracking URL in phishing email | Trustifi (legitimate service, abused) |

    | 2. Obfuscation | Redirect through Cloudflare Workers and obfuscated JavaScript | Multiple anonymization layers |

    | 3. Phishing Page | Victim lands on fake Microsoft CAPTCHA page | Tycoon2FA-hosted infrastructure |

    | 4. OAuth Exploitation | Victim pastes device code at microsoft.com/devicelogin and completes MFA | Microsoft's legitimate OAuth device flow |


    Why Trustifi?


    The attackers leverage Trustifi's legitimate click-tracking feature—used by enterprises for email security and analytics—as a first-hop redirect. This buys them credibility and makes the initial redirect appear legitimate. eSentire researchers note they cannot determine how the attackers gained the ability to abuse Trustifi URLs, leaving an important gap in the investigation.


    ### Anti-Analysis Protections


    Tycoon2FA includes robust protections designed to evade automated detection and researcher analysis. The kit's blocklist contains 230+ vendor names and is continuously updated.


    Blocked tools include:

  • Browser automation frameworks: Selenium, Puppeteer, Playwright
  • Security testing platforms: Burp Suite
  • Sandboxed analysis environments
  • VPN services
  • Common cloud providers
  • AI crawlers
  • Debugger environment detection via timing traps

    • Any request from an analysis environment is automatically redirected to a legitimate Microsoft page, making the attack invisible to automated scanning and security research.


    ## Implications: The Scope of Exposure


    Device-code phishing succeeds because it bypasses many traditional security controls:


  • MFA is not protection: The victim completes their legitimate MFA as part of the attack. From Microsoft's perspective, the authentication is successful and secure.
  • No credential theft: Phishing kits don't capture passwords or MFA codes—they steal OAuth tokens after legitimate authorization. Traditional credential monitoring misses this entirely.
  • Full account access: Once tokens are issued to the attacker-controlled device, the attacker has unrestricted access to all Microsoft 365 services: email, calendar, OneDrive, Teams, SharePoint, and more.
  • Persistence: OAuth tokens can be long-lived. Attackers may maintain access for weeks or months without the victim's knowledge.
  • Compliance complexity: Many organizations monitor failed logins but not successful logins from new devices, leaving this attack pattern invisible to standard logging.

    • Organizations using Microsoft 365 are the primary targets, but any service using OAuth 2.0 device flows (including Google Workspace) is at risk.


    ## Recommendations: Hardening Against Device-Code Attacks


    Microsoft and security researchers recommend a defense-in-depth approach:


    Identity and Access Management:

  • Disable device-code flow when not required in your Azure AD configuration
  • Restrict OAuth consent permissions to the minimum necessary for business functions
  • Require admin approval for all third-party app integrations
  • Implement Continuous Access Evaluation (CAE) to revoke tokens when risk conditions change

    • User and Endpoint Security:

  • Educate users on device-code phishing (the attack doesn't look like a traditional phishing page)
  • Monitor for new device registrations from unusual geographic locations or IP addresses
  • Enforce compliant device access policies to ensure managed devices and zero-trust principles
  • Implement conditional access rules that require additional verification for new device logins

    • Detection and Response:

  • Monitor OAuth token issuance for anomalies: new device registrations, unusual resource access patterns
  • Review device registrations regularly in Azure AD → Devices
  • Alert on suspicious OAuth activity, particularly bulk data exfiltration or forwarding rule changes

    • ## HackWire Analysis


    Tycoon2FA's rapid resurrection and technical evolution reveal a critical imbalance in the cat-and-mouse game between law enforcement and organized cybercrime. Disruptions work only if the underlying economic model is disrupted—and phishing-as-a-service remains highly profitable.


    The 37x surge in device-code phishing this year is not an anomaly; it's a rational response by threat actors to the effectiveness of this technique. Unlike password-based phishing, which faces increasingly robust MFA defenses, device-code attacks have no equivalent mitigation that works at the user level. The victim's MFA works *against* them, not for them, because it legitimizes the attack.


    The real risk is organizational blind spots. Most companies monitor failed logins and password sprays. Few monitor successful logins from new devices or OAuth token issuance anomalies. A sophisticated attacker can compromise a Microsoft 365 account, exfiltrate email and cloud data, establish persistence, and remain undetected for weeks—all while appearing as a successful authentication in logs.


    Trustifi's involvement—whether through compromise or misconfigurations we don't yet understand—is also troubling. Legitimate email security tools being weaponized as attack infrastructure suggests either a supply-chain gap or a sophisticated compromise of a third-party service. Until we understand how, we should expect other legitimate services to be abused in similar ways.


    Organizations should treat device-code phishing as an imminent threat, not a future concern. The sophistication is already here, the tooling is already commercialized, and every major phishing platform now supports it. If you're running Microsoft 365 without device-code flow restrictions and OAuth token monitoring, you're operating with a significant blind spot. — HackWire Editorial


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)