Tycoon 2FA Operators Use OAuth Device Code Phishing to Bypass MFA

A new phishing campaign uncovered in late April 2026 shows how threat actors behind the Tycoon 2FA Phishing-as-a-Service (PhaaS) kit are evolving beyond traditional credential theft. This development comes just weeks after a global takedown effort led by Microsoft and Europol disrupted Tycoon 2FA infrastructure. Despite that operation, the actors have quickly adapted, reusing their […]

The post Tycoon 2FA Operators Use OAuth Device Code Phishing to Bypass MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.