Tycoon 2FA Operators Turn to OAuth Device-Code Phishing to Steal Microsoft 365 Tokens
Summary
eSentire analyzes a Tycoon 2FA campaign that uses a multi-layer phishing chain to trick victims into authorizing OAuth device codes, giving operators Microsoft 365 tokens despite successful MFA.
Key points
- The campaign repurposes Tycoon 2FA’s existing phishing kit for OAuth device-code phishing; it does not capture passwords or proxy Microsoft’s sign-in page.
- A Trustifi click-tracking link redirects victims through a Cloudflare Workers subdomain to a fake Microsoft voicemail lure and device-login instructions.
- Victims enter an attacker-issued code at Microsoft’s legitimate device-login page and approve a Microsoft Authentication Broker consent prompt; the operator then receives tokens.
- The kit retains recognizable fingerprints, including a Check Domain URL pattern, AES-CBC encryption with a hardcoded key and IV, anti-debug checks, and Base64/XOR wrapping.
- eSentire observed operator activity from Alibaba Cloud ASN AS45102, with “node” and “undici” user agents; refresh-token reuse continued after revocation.
- The SOC isolated affected accounts, revoked sessions and refresh tokens, and audited application consents. Recommended defenses include restricting device-code authentication and user consent, and hunting for anomalous Entra sign-ins.
Article Details
- Attack Vectors
- A forwarded vendor-invoice email used a Trustifi click-tracking link that redirected through a disposable Cloudflare Workers subdomain to deliver the phishing content.
- A four-layer in-browser chain used encrypted and obfuscated JavaScript, anti-analysis checks, ASN-based filtering, and a decoy branch to control what visitors saw.
- A Microsoft 365 voicemail-themed lure directed victims to enter an operator-issued device code at Microsoft's legitimate device-login page and consent to token issuance for Microsoft Authentication Broker.
- The kit polled its operator backend for device-code flow status and forwarded victim session coordination data, including browser, IP, and country information.
- After consent, operators used issued tokens to access Exchange Online and Microsoft Graph and continued attempting refresh-token reuse after revocation.
- Defensive Notes
- Block OAuth Device Code authentication for end users with Conditional Access, allowing it only for explicitly approved scenarios.
- Restrict OAuth application consent and require administrator approval for third-party applications.
- Enable Continuous Access Evaluation and revoke refresh-token chains promptly after suspected compromise.
- Apply device-compliance policies to limit access to managed and compliant devices.
- Hunt for successful device-code sign-ins involving Microsoft Authentication Broker and the user agents "node", "undici", or "axios/*", including repeated error 50173 events after token revocation.
- Review mailbox rules, OAuth application consents, and forwarding configurations after a suspected successful phish.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fijothi[.]com | Operator backend domain receiving encrypted session-coordination requests and returning device-code flow status. |
| HOSTNAME | cookies[.]28gholland[.]workers[.]dev | Disposable Cloudflare Workers subdomain used as the delivery point for the malicious payload. |
| IPV4 | 47[.]252[.]11[.]99 | Operator-side IP observed during sustained refresh-token reuse. |
| IPV4 | 47[.]90[.]180[.]205 | Operator-side IP observed during device-code token acquisition and post-consent activity. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe delivery chain used encrypted payloads, Base64 wrapping, and obfuscated JavaScript string construction to hinder analysis.T1204.001 · Malicious LinkThe victim clicked the lure link and followed the instructions to enter a device code and approve the OAuth consent.T1497.001 · System ChecksThe scripts checked for headless-browser and automation indicators, proxy-related signals, and debugging activity before deciding whether to show the lure or redirect.T1528 · Steal Application Access TokenThe operators induced consent to a device-code flow and obtained Microsoft-issued access and refresh tokens.T1550.001 · Application Access TokenAfter token issuance, the operators used tokens to access Exchange Online and Microsoft Graph and attempted continued refresh-token reuse.T1566.002 · Spearphishing LinkThe campaign delivered a phishing lure by email with a click-tracking link that redirected to the malicious content.
Vendors
Alibaba CloudOperator polling activity originated from AS45102 (Alibaba Cloud) with user-agent strings "node" and "undici" - Node.js HTTP library signatures distinct from the axios/1.x fingerprint documented in TRU's prior TycoonCloudflareOn click, Trustifi issues an HTTP 307 redirect to a Cloudflare Workers throwaway subdomain:Microsoftof the Tycoon 2FA Phishing-as-a-Service (PhaaS) kit despite the March 2026 coalition takedown led by Microsoft and Europol in collaboration with eSentire and other industry partners; the second is the broader shiftTrustifiThe attack begins when a victim clicks a Trustifi click-tracking URL in a lure email and culminates in the victim unknowingly granting OAuth tokens to an attacker-controlled device through Microsoft's legitimate
Products
Cloudflare WorkersOn click, Trustifi issues an HTTP 307 redirect to a Cloudflare Workers throwaway subdomain:Exchange Online29d9ed98-a469-4536-ade2-f981bc1d605e), a Microsoft first-party application that brokers tokens to Exchange Online, Microsoft Graph, and OneDrive for Business. A single successful consent yields working tokens forMicrosoft 365the second is the broader shift toward abusing OAuth Device Authorization Grant flows to compromise Microsoft 365 accounts.Microsoft Authentication BrokerThe OAuth client the operator impersonates is Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e), a Microsoft first-party application that brokers tokens to Exchange Online, Microsoft Graph,Microsoft EntraImplement Microsoft Entra Conditional Access policies that block OAuth Device Code authentication flows for end-users, allowing them only for explicitly defined developer or device-onboarding scenarios. This singleMicrosoft Grapha Microsoft first-party application that brokers tokens to Exchange Online, Microsoft Graph, and OneDrive for Business. A single successful consent yields working tokens for the entireOneDrive for Businessa Microsoft first-party application that brokers tokens to Exchange Online, Microsoft Graph, and OneDrive for Business. A single successful consent yields working tokens for the entire Microsoft 365 surface area while
Tools
CyberChefThe AES-GCM unwrap can be reproduced in CyberChef using the inline key, IV, and tag values:Tycoon 2FAcombines two trends TRU has tracked over the past year. The first is the continued operation of the Tycoon 2FA Phishing-as-a-Service (PhaaS) kit despite the March 2026 coalition takedown led by Microsoft and