## Overview

Tycoon 2FA is a high-volume Phishing-as-a-Service (PhaaS) platform that has been tracked since 2023. Following a March 2026 Microsoft Digital Crimes Unit / Europol coalition takedown — conducted in collaboration with eSentire and other industry partners — the operators retained their source code and rebuilt on new infrastructure within weeks (Abnormal Security confirmed the rebound in early May 2026). The eSentire Threat Response Unit (TRU) analyzed an active campaign in late April 2026 that demonstrates a fundamental tradecraft shift: the kit no longer attempts to proxy Microsoft credentials at all. Instead, it has been repurposed as a delivery framework for OAuth 2.0 Device Authorization Grant phishing (also known as device-code phishing or DCP).

This is part of a broader ecosystem trend. Push Security reports OAuth device-code phishing volume has surged approximately 37x year-over-year and is now supported by at least ten PhaaS platforms and private kits; Proofpoint independently documents a parallel surge.

## Attack Chain

**Stage 0 — Lure delivery.** Victim receives an invoice-themed email containing a URL of the form `https://events.trustifi.com/api/o/v1/click/<MongoDB_ObjectId>/<recipient_hex>/...`. Trustifi is a legitimate enterprise email-security platform; its click-tracker is being abused as designed for reputation laundering. The first eight hex characters of the ObjectId encode the Unix timestamp at which the tracking record was created — the ObjectId `69f218d9bd8f28639a2460c7` from this campaign decodes to April 29, 2026 at 14:42:33 UTC. The third-party sending domain authenticated cleanly via SPF and DKIM but published no DMARC record, removing the recipient gateway's downstream sender-policy signal.

**Stage 1 — Cloudflare Workers handoff.** Trustifi issues an HTTP 307 redirect to a disposable `*.workers.dev` subdomain (observed: `cookies.28gholland.workers.dev`). The Worker returns an HTML page containing a base64-encoded AES-GCM-encrypted payload with the key, IV, and authentication tag inlined; decryption is performed in the victim's browser via SubtleCrypto and rendered into the DOM with `document.write()`. The unwrapper avoids literal `eval`/`atob` strings by reconstructing them from `.slice()` calls on dictionary words (a Tycoon 2FA fingerprint).

**Stage 2 — Anti-analysis gates.** The decrypted controller script performs four independent checks before rendering anything malicious:

1. *Headless / proxy detection* — `navigator.webdriver`, `window.callPhantom`, `window._phantom`, and `navigator.userAgent` substring "Burp". Positive match replaces the page with `about:blank`, blocking Selenium, Puppeteer, Playwright, PhantomJS, and Burp Suite traffic. 2. *Dev-tools suppression* — a keydown listener calls `preventDefault()` on F12, Ctrl+U, Ctrl+Shift+I/C/J/K, Ctrl+H, Cmd+Alt+I/C, Cmd+U; a `contextmenu` listener disables right-click. 3. *Debugger timing trap* — every 100 ms, the script measures the wall-clock delta around a bare `debugger;` statement. If a debugger pauses execution and the delta exceeds 100 ms, the page is redirected to legitimate `https://www.microsoft.com`. (Same construction documented in the eSentire April 2025 "Phish & Chips" blog.) 4. *ASN-based vendor filtering* — the script fetches `https://ipinfo.io/json` and compares `response.org` against a hardcoded 230-vendor blocklist covering AWS / GCP / Azure / Oracle / DigitalOcean / Hetzner / OVH / Vultr / Linode / Leaseweb / M247, VirusTotal / Hybrid Analysis / Any.Run / Joe Sandbox / Cuckoo / URLScan / Intezer, Proofpoint / Mimecast / Cloudflare / Zscaler / Forcepoint / Barracuda / Akamai / Fastly / Palo Alto / Fortinet / Cisco, Kaspersky / ESET / Bitdefender / Avast / AVG / Sophos / McAfee / Trend Micro / Symantec / G-Data / Avira, BrandVerity / RiskIQ / Netcraft / MarkMonitor / ZeroFox / Group-IB, GPTBot / ChatGPT / OpenAI / Claude / Anthropic / Perplexity / CCBot / Bytespider / PetalBot, NordVPN / ExpressVPN / Surfshark / ProtonVPN / CyberGhost / PIA / Mullvad / Windscribe, Bright Data / Luminati / Oxylabs / Smartproxy / SOAX. Any match redirects to `https://outlook.cloud.microsoft/mail/`. 5. *Time-bounded expiry* — `if (1780012800 < Math.floor(Date.now()/1000))` renders the literal string "Expired". The timestamp 1780012800 decodes to May 29, 2026 at 00:00:00 UTC, giving each deployed sample an approximately one-month operational tail.

**Stage 3 — HumanCheck + Check Domain branching.** The cleartext from Stage 2 is a Microsoft-branded fake CAPTCHA ("HumanCheck") page styled with the four Microsoft logo tile colors. The entire anti-analysis stack is repeated. On click, the page issues a GET to a Tycoon 2FA "Check Domain" — `https://shivacrio.com/bytecore~tx1j8` in this campaign — which the URLscan hunting regex published by TRU in April 2026 (`page.url:/.*\..*\.[a-z]{2,10}\/[a-zA-Z0-9]{1,20}[~!@$][a-zA-Z0-9]{1,20}/`) matches exactly. The behavior of the response has evolved: prior variants returned `0` or `1` and blocked outright on non-zero; this variant interprets the response as a fork — `0` proceeds to the device-code lure (`document.write(atob('<base64_voicemail_lure>'))`), non-zero renders a complete benign "NexusCore" fictional-registrar decoy site. Decoy-on-detection preserves operational secrecy that hard-blocking surrenders.

**Stage 4 — Device-code lure.** Victims who pass the Check Domain are shown a Microsoft 365 voicemail-themed page ("Voicemail_Message.mp3"). A spinner displays while the operator backend contacts Microsoft's `/devicecode` endpoint to obtain a fresh `device_code` / `user_code` pair. The page then displays the user code with a "Copy Code" button and a three-step instruction list. Clicking Copy Code places the code on the clipboard and opens `https://microsoft.com/devicelogin` in a popup. The victim pastes the code, signs in normally, satisfies any MFA challenge (phone-app push), and clicks Continue on the consent prompt — at which point Microsoft issues access and refresh tokens to the operator's polling client via `/organizations/oauth2/v2.0/token`. The victim is then cosmetically redirected to `https://outlook.cloud.microsoft/mail/` (their real inbox), leaving no apparent indicator of compromise.

**Stage 5 — Operator backend communication.** All POSTs go to `https://fijothi.com/dhkjCVBfLnfbhFjpYPoDKNMmLIQjNkGLMQPMQUBJFWELKIYHJHWDIESXVUZHHJNFTNMW<random>` — a fixed 68-character static path prefix followed by a per-request `randexp.js`-generated routing suffix matched against five hardcoded regular expressions. The starting bytes of the suffix act as a route discriminator: `codeemailtoken` (76|80) bootstraps the session, `emailtokencookie` (41|42) requests a fresh `device_code`, `emailtoken` (49|52) submits a harvested email, `checkemailtoken` (65|74) generic poll, `checkemailtokencookie` (67|86) the five-second-interval polling loop. Every request body is encrypted with CryptoJS AES-CBC using `key = iv = '1234567890123456'`, PKCS#7 padding, wrapper functions `encryptData()` / `decryptData()` — byte-for-byte identical to the encryption layer documented in the April 2025 "Phish & Chips" and April 2026 infrastructure-update blogs. The kit also calls `https://api.ipbase.com/v1/json/` for victim IP/country enrichment, joining `ipinfo.io`, `api.ipapi.is`, and `get.geojs.io` on TRU's list of legitimate IP-intelligence services abused by Tycoon 2FA.

## Why Device-Code Phishing Defeats MFA

The OAuth 2.0 Device Authorization Grant (RFC 8628) was designed for input-constrained devices (smart TVs, CLI tools, IoT appliances) where typing credentials is impractical. The protocol is intentionally indirect: the device asks the IdP for a short user-facing code, the user enters that code from a different browser, signs in normally, and the IdP returns tokens to the original device. **There is no cryptographic binding between the device that requested the code and the user's identity.** Anyone who initiates a device-code grant for a Microsoft first-party AppId can collect the resulting tokens from any user who consents.

The phish does not bypass MFA — it changes what MFA is being used to authorize. The user thinks they are approving access for a voicemail player; they are actually approving token issuance to an attacker-controlled device.

## The Microsoft Authentication Broker Pivot

The OAuth client the operator impersonates is **Microsoft Authentication Broker — AppId `29d9ed98-a469-4536-ade2-f981bc1d605e`** — a Microsoft first-party application. There are two consequences for defenders:

1. The application appears in Entra telemetry as a normal Microsoft app, not an unknown third-party OAuth app, so it does not trigger unverified-publisher detections that catch many OAuth phishing campaigns. 2. Microsoft Authentication Broker is a *broker* application — the token issued at consent can be exchanged for tokens scoped to other Microsoft resources (Exchange Online, Microsoft Graph, OneDrive for Business) without further user interaction. **One consent unlocks a token chain across the entire Microsoft 365 surface area.**

Network captures show the consent prompt advertises Microsoft Authentication Broker, but the subsequent `/authorize` request carries a different resource AppId — `9199bf20-a13f-4107-85dc-02114787ef48` (One Outlook Web) — confirming the broker-to-resource exchange.

## Operator Telemetry Footprint

Observed operator activity against the compromised identity (from Entra sign-in logs):

| Phase | Source IP | User-Agent | Event | |---|---|---|---| | Initial credential attempt | 47.90.180.205 (AS45102) | — | email/password submitted to Microsoft Authentication Broker; Entra returns errorCode 50199 ("user confirmation is required"); operator pivots to device-code grant | | Device-code consent | 47.90.180.205 (AS45102) | — | `AuthenticationProtocol = deviceCode` succeeds; tokens issued; MFA requirement satisfied by claim in token | | Immediate post-consent | 47.90.180.205 (AS45102) | `node` | three near-simultaneous non-interactive token uses against Exchange Online (x2) and Microsoft Graph (x1) within two seconds | | Sustained use | 47.252.11.99 (AS45102) | `undici` | nine non-interactive sign-in events against Exchange Online and Microsoft Graph over ~3 hours; all return errorCode 50173 ("the provided grant has expired due to it being revoked") — IR team had revoked the refresh-token chain but operator automation continued retrying |

The long-tail retry pattern is a strong post-compromise detection signal even after token revocation. `undici` is the modern Node.js native HTTP client library (the implementation behind global `fetch` in Node 18+); the bare `node` UA is the default for `node-fetch` and similar libraries when no explicit User-Agent header is set. Both are signatures of a Node.js automation backend. This is an evolution from the `axios/1.x` UA fingerprint documented across prior credential-relay-variant Tycoon 2FA reporting — defenders should now watch for all three (`axios/*`, `undici`, `node`) against the Microsoft Authentication Broker AppId in non-interactive sign-in logs.

AS45102 (Alibaba (US) Technology Co., Ltd.) has been observed as an active operator-side ASN across both the credential-relay and device-code variants of Tycoon 2FA since approximately April 10, 2026, and should be treated as an addition to (not replacement of) the post-takedown watchlist: AS9009 (M247), AS214238 (HOST TELECOM), AS62240 (Clouvider), AS204957 (GREEN FLOID), AS395092 (Shock Hosting), AS215540 (GLOBAL CONNECTIVITY SOLUTIONS).

## Continuity Fingerprints

Multiple independent source-code fingerprints carry over from prior Tycoon 2FA kits and together constitute strong attribution evidence: …