Tycoon 2FA Adopts OAuth Device Code Attacks In MFA Bypass Campaign

Threat actors rarely stay down for long. Just weeks after a massive global takedown in March 2026, the notorious Tycoon 2FA Phishing-as-a-Service (PhaaS) kit has resurfaced with a dangerous new trick.

Instead of stealing passwords, cybercriminals are now abusing Microsoft’s OAuth Device Authorization Grant flow to bypass Multi-Factor Authentication (MFA) entirely.

Security researchers at the eSentire Threat Response Unit (TRU) recently uncovered this evolving campaign.

Attackers are successfully weaponizing legitimate Microsoft infrastructure, turning a user’s own security protocols against them to gain complete, silent access to Microsoft 365 environments.

Tycoon 2FA Bypasses MFA

The attack sequence begins with a deceptive email, often disguised as a vendor invoice or a Microsoft 365 voicemail notification.

To evade email security gateways, attackers launder their reputation by utilizing legitimate click-tracking URLs from enterprise platforms like Trustifi.

Once clicked, victims are routed through an invisible, four-layer browser delivery chain heavily fortified with anti-analysis filters.

The PhaaS kit actively cross-references visitors against a massive blocklist of 230 security vendors, cloud providers, and AI crawlers to keep researchers out.

const t1 = performance.now();
debugger;
const t2 = performance.now();
if (t2 - t1 > 100) {
    window.location.replace('https://www.microsoft.com');
}

If the target passes these checks, they are presented with a fake Microsoft voicemail page and a generated user code.

Victims are instructed to enter this code at the genuine Microsoft device login portal. Because the portal is completely real, the victim’s MFA works perfectly. However, the user is not authorizing their own browser session.

Instead, they are unknowingly granting an attacker-controlled device masquerading as the legitimate “Microsoft Authentication Broker” full access to their Exchange Online, Microsoft Graph, and OneDrive accounts.

Behind the scenes, the Tycoon 2FA operators have repurposed their existing infrastructure.

The underlying code remains remarkably identical to older versions, complete with the same AES-CBC encryption layer and a hardcoded decryption key of “1234567890123456”.

Rather than intercepting credentials via a proxy, the kit coordinates the session data and quietly hands the generated OAuth tokens to the attackers’ Node.js backend.

This means the user’s MFA is satisfied on Microsoft’s end, rendering traditional credential theft alerts useless.

Indicators of Compromise

According to eSentire research, defenders must look beyond standard phishing signatures to catch this variant. The threat actors have shifted their hosting infrastructure to Alibaba Cloud.

They are using distinct automation signatures to poll for tokens. Below are the key indicators for hunting this device-code campaign.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.