Threat Intelligence / Actor / Tycoon 2FA operators

Tycoon 2FA operators

1 tracked threat(s) · Categories: PHISHING

Also known as: Tycoon2FA, Tycoon 2FA PhaaS

Tracked threats

Tycoon 2FA Adopts OAuth 2.0 Device-Code Phishing — PhaaS Kit Hijacks Microsoft 365 Accounts via Microsoft Authentication Broker (AppId 29d9ed98) Through Trustifi Click-Tracking and Cloudflare Workers Delivery (eSentire TRU TL-2026-0522) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence