Tycoon 2FA Adopts OAuth 2.0 Device-Code Phishing — PhaaS Kit Hijacks Microsoft 365 Accounts via Microsoft Authentication Broker (AppId 29d9ed98) Through Trustifi Click-Tracking and Cloudflare Workers Delivery (eSentire TRU TL-2026-0522) — Threadlinqs Intelligence
As of 2026-05-30, Tycoon 2FA Adopts OAuth 2.0 Device-Code Phishing — PhaaS Kit Hijacks Microsoft 365 Accounts via Microsoft Authentication Broker (AppId 29d9ed98) Through Trustifi Click-Tracking and Cloudflare Workers Delivery (eSentire TRU TL-2026-0522) is a high-severity phishing threat attributed to Tycoon 2FA operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0522 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: Tycoon 2FA operators · FINANCIAL
Tycoon 2FA, the Phishing-as-a-Service (PhaaS) platform that survived the March 2026 Microsoft/Europol coalition takedown, has been re-tooled to deliver OAuth 2.0 Device Authorization Grant (RFC 8628)
## Overview
Tycoon 2FA is a high-volume Phishing-as-a-Service (PhaaS) platform that has been tracked since 2023. Following a March 2026 Microsoft Digital Crimes Unit / Europol coalition takedown — conducted in collaboration with eSentire and other industry partners — the operators retained their source code and rebuilt on new infrastructure within weeks (Abnormal Security confirmed the rebound in early May 2026). The eSentire Threat Response Unit (TRU) analyzed an active campaign in late April 2026 that demonstrates a fundamental tradecraft shift: the kit no longer attempts to proxy Microsoft credentials at all. Instead, it has been repurposed as a delivery framework for OAuth 2.0 Device Authorization Grant phishing (also known as device-code phishing or DCP).
This is part of a broader ecosystem trend. Push Security reports OAuth device-code phishing volume has surged approximately 37x year-over-year and is now supported by at least ten PhaaS platforms and private kits; Proofpoint independently documents a parallel surge.
## Attack Chain
**Stage 0 — Lure delivery.** Victim receives an invoice-themed email containing a URL of the form `https://events.trustifi.com/api/o/v1/click/<MongoDB_ObjectId>/<recipient_hex>/...`. Trustifi is a legitimate enterprise email-security platform; its click-tracker is being abused as designed for reputation laundering. The first eight hex characters of the ObjectId encode the Unix timestamp at which the tracking record was created — the ObjectId `69f218d9bd8f28639a2460c7` from this campaign decodes to April 29, 2026 at 14:42:33 UTC. The third-party sending domain authenticated cleanly via SPF and DKIM but published no DMARC record, removing the recipient gateway's downstream sender-policy signal.
**Stage 1 — Cloudflare Workers handoff.** Trustifi issues an HTTP 307 redirect to a disposable `*.workers.dev` subdomain (observed: `cookies.28gholland.workers.dev`). The Worker returns an HTML page containing a base64-encoded AES-GCM-encrypted payload with the key, IV, and authentication tag inlined; decryption is performed in the victim's browser via SubtleCrypto and rendered into the DOM with `document.write()`. The unwrapper avoids literal `eval`/`atob` strings by reconstructing them from `.slice()` calls on dictionary words (a Tycoon 2FA fingerprint).
**Stage 2 — Anti-analysis gates.** The decrypted controller script performs four independent checks before rendering anything malicious:
1. *Headless / proxy detection* — `navigator.webdriver`, `window.callPhantom`, `window._phantom`, and `navigator.userAgent` substring "Burp". Positive match replaces the page with `about:blank`, blocking Selenium, Puppeteer, Playwright, PhantomJS, and Burp Suite traffic.
2. *Dev-tools suppression* — a keydown listener calls `preventDefault()` on F12, Ctrl+U, Ctrl+Shift+I/C/J/K, Ctrl+H, Cmd+Alt+I/C, Cmd+U; a `contextmenu` listener disables right-click.
3. *Debugger timing trap* — every 100 ms, the script measures the wall-clock delta around a bare `debugger;` statement. If a debugger pauses execution and the delta exceeds 100 ms, the page is redirected to legitimate `https://www.microsoft.com`. (Same construction documented in the eSentire April 2025 "Phish & Chips" blog.)
4. *ASN-based vendor filtering* — the script fetches `https://ipinfo.io/json` and compares `response.org` against a hardcoded 230-vendor blocklist covering AWS / GCP / Azure / Oracle / DigitalOcean / Hetzner / OVH / Vultr / Linode / Leaseweb / M247, VirusTotal / Hybrid Analysis / Any.Run / Joe Sandbox / Cuckoo / URLScan / Intezer, Proofpoint / Mimecast / Cloudflare / Zscaler / Forcepoint / Barracuda / Akamai / Fastly / Palo Alto / Fortinet / Cisco, Kaspersky / ESET / Bitdefender / Avast / AVG / Sophos / McAfee / Trend Micro / Symantec / G-Data / Avira, BrandVerity / RiskIQ / Netcraft / MarkMonitor / ZeroFox / Group-IB, GPTBot / ChatGPT / OpenAI / Claude / Anthropic / Perplexity / CCBot / Bytespider / PetalBot, NordVPN / ExpressVPN / Surfshark /
Weaknesses (CWE)
CWE-1390, CWE-287, CWE-602, CWE-345
Target sectors: financial-services, professional-services, legal, manufacturing, healthcare, government, education, technology, retail, all-microsoft-365-tenants
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1589, T1583, T1608, T1587, T1566, T1199, T1204, T1528, T1621, T1606
