# Tycoon 2FA Adversary-in-the-Middle Phishing-as-a-Service (Storm-1747) — MFA-Bypass Kit Targeting Microsoft 365 & Gmail

> Tycoon 2FA is a widely deployed Adversary-in-the-Middle (AiTM) Phishing-as-a-Service platform operated by Storm-1747 that uses reverse-proxy relays to capture credentials, relay MFA challenges, and steal authenticated session cookies for Microsoft 365 and Gmail, enabling full account takeover that survives password resets. At its peak it accounted for roughly 62% of phishing attempts blocked by Microsoft and reached over 500,000 organizations per month before a March 2026 Microsoft/Europol-led disruption.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0818
- **ID:** TL-2026-0818
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-1747
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Tycoon 2FA is a Phishing-as-a-Service (PhaaS) platform first observed by Sekoia in October 2023 (active since August 2023) and attributed by Microsoft Threat Intelligence to the actor tracked as Storm-1747, with documented infrastructure and tooling overlaps to the Dadsec/Saint operation. The kit defeats multi-factor authentication using an Adversary-in-the-Middle (AiTM) reverse-proxy architecture: a victim is lured to a spoofed Microsoft 365, Outlook, SharePoint, OneDrive, or Gmail sign-in portal that transparently relays the victim's username, password, and MFA response to the legitimate service while intercepting the resulting authenticated session cookie. Because the attacker captures the live session token, the resulting account access bypasses SMS codes, one-time passcodes, and push-notification MFA and persists even if the victim later changes their password.

Delivery uses email lures in four observed forms: PDF/DOC/DOCX attachments containing QR codes, SVG files with embedded redirect logic, HTML attachments with short messages, and direct redirect links appearing to originate from trusted services. Victims are funneled through multi-layer redirect chains abusing legitimate intermediaries (Azure Blob Storage, Firebase, Wix, TikTok) and Cloudflare-hosted domains, including Cloudflare Workers URLs used for automated subdomain rotation. Early versions gated traffic behind a Cloudflare Turnstile challenge; later versions shifted to a custom CAPTCHA built from randomized HTML5 canvas elements. The kit performs aggressive cloaking and anti-analysis: datacenter-IP and Tor filtering, geolocation restrictions, user-agent profiling, browser fingerprinting, dead-code injection, Base64/Base91 and invisible-Unicode obfuscation (built with the public 'javascript-obfuscator' tool), keystroke monitoring, and copy/paste, right-click, and developer-tool blocking. Captured data — email, password, 2FA code, IP, user-agent, session ID, and fingerprint — is exfiltrated over a Socket.IO WebSocket channel and forwarded to operators via Telegram bots. Access is sold on Telegram at roughly $120 for 10-day and $350 for 30-day panel access.

Despite a coordinated March 2026 takedown led by the Microsoft Digital Crimes Unit and Europol that seized over 300 domains, operators adapted within weeks, rotating to short-lived (24-72 hour) FQDNs and shifting subdomain naming from high-entropy strings to readable, benign-looking terms. Organizations should treat Tycoon 2FA as an ongoing identity-compromise threat and prioritize phishing-resistant MFA, session-token protection, and AiTM-aware detection.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1566 Phishing
- T1557 Adversary-in-the-Middle
- T1056 Input Capture
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1187 Forced Authentication
- T1110 Brute Force
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1115 Clipboard Data
- T1137 Office Application Startup
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/)
- [Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit](https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/)
- [Tycoon 2FA: Phishing Kit Being Used to Bypass MFA](https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass)
- [PhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec's Operations](https://www.levelblue.com/blogs/spiderlabs-blog/phaas-the-secrets-the-hidden-ties-between-tycoon2fa-and-dadsecs-operations)
- [Tycoon 2FA AiTM detection for Entra ID and Google](https://www.elastic.co/security-labs/tycoon-2fa-aitm-detection-engineering)
- [New Tycoon 2FA Phishing Kit Raises Cybersecurity Concerns](https://www.infosecurity-magazine.com/news/new-tycoon-2fa-phishing-kit/)
- [Top 5 Phishing Domain Takedown Services (originating source feed)](https://socradar.io/blog/top-5-phishing-domain-takedown-service/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0818