What Changed
In March 2026, law enforcement disrupted 330 domains linked to Tycoon 2FA, a major phishing kit in Okta's Identity Threat Protection telemetry. While detections initially dropped, they soon spiked, revealing a shift in tactics rather than a complete halt. Attempts dropped from 11,199 in July 2025 to 885 just before the takedown, then rose to 1,470 immediately after. By April 2026, they settled at 631.
The infrastructure also diversified quickly. Previously, Tycoon 2FA operated on three hosting providers. Within two days of the takedown, operators spread across four new networks, retaining only one original provider.
The most significant change was in tactics. Proofpoint researchers found a PDF in a device code phishing campaign reusing a Tycoon 2FA URL artifact. Okta Threat Intelligence noted similarities in anti-analysis techniques between old Tycoon campaigns and new device code phishing attempts, including identical CAPTCHA implementations and matching redirect chains.
Key Findings
Attacker-in-the-Middle phishing remains effective because passwords and OTPs are still vulnerable. Tycoon 2FA's reverse proxy captured credentials, relayed MFA challenges, and intercepted session tokens, bypassing both login and second factors. This attack was available for a few hundred dollars per month via Telegram channels.
Device code phishing exploits OAuth 2.0 Device Authorization Grant flows. Users authenticate on a separate device after receiving a code, allowing OAuth tokens to be issued to the requesting client. Attackers exploit this by tricking victims into approving access for an application not on their device. Kits like EvilTokens now offer this as a service.
Law enforcement disruption imposes costs but doesn't eliminate capability. Tycoon operators rebuilt infrastructure within 48 hours and shifted to device code attacks. The takedown fragmented the ecosystem rather than stopping it.
Session token replay is now a primary post-authentication attack vector. Once an attacker has a valid session token, they can bypass both login and MFA, whether the token was stolen through phishing, malware, or device code abuse.
What This Means for Your Team
Your authentication architecture determines your vulnerability to these attacks. If you're using passwords plus OTPs, you're at risk from both Attacker-in-the-Middle and device code phishing. The session token is the main target, and current MFA doesn't protect it.
Device code phishing is harder to detect because authentication occurs on legitimate Microsoft or Google login pages. Users see real URLs, certificates, and branding. The only clue is the device code prompt, which many users won't recognize as suspicious.
You can't rely on law enforcement to solve this problem. The Tycoon 2FA takedown shows that skilled operators quickly rebuild and adapt. Your defenses must be effective regardless of the current phishing kit trend.
Action Items by Priority
Priority 1: Enforce phishing-resistant authenticators for all users with access to sensitive data or administrative functions. Deploy FIDO2 security keys, passkeys, or Okta FastPass. These cryptographic authenticators bind to the origin domain and can't be proxied or replayed, blocking both Attacker-in-the-Middle and device code phishing.
Priority 2: Restrict OAuth 2.0 Device Authorization Grant flows to known, approved applications. Implement Conditional Access policies that block device code flows except for trusted clients. Microsoft Entra ID supports this via authentication context. If you're using a different identity provider, check if you can disable device code grants per application.
Priority 3: Deploy session token monitoring and anomaly detection. If you can't enforce phishing resistance immediately, implement controls to detect token reuse from unexpected locations, devices, or network contexts. Look for impossible travel patterns, mismatched device fingerprints, or tokens used from IP addresses that don't match the authentication source.
Priority 4: Review your authentication policy hierarchy. Identify which user groups still use passwords and OTPs. Create a migration plan with clear timelines. Start with privileged users, then move to employees with access to customer data, financial systems, or intellectual property.
Priority 5: Test your detection capabilities against device code phishing. Simulate an attack: generate a device code, authenticate from a different device, and verify if your security stack flags the activity. If you're using Okta FastPass, ensure administrators receive server-side detections when users are targeted.
What Not to Do
Don't assume SMS or authenticator app OTPs offer meaningful protection. Tycoon 2FA's success, with 11,199 detections in one month, shows these factors are routinely bypassed.
Don't rely solely on user training. Even security-aware users can fall for device code phishing because the authentication page is legitimate. The attack doesn't depend on users failing to spot a fake URL.
Don't wait for "the right time" to switch to phishing-resistant authentication. Operators are already diversified and rebuilding. The threat isn't going away.
