Tycoon2FA: Why Takedowns Aren't Kill Shots — Analyzing a PhaaS Platform's Post-Disruption Evolution

Executive Summary

On March 4, 2026, a coalition led by Europol and Microsoft — with support from Trend Micro, Cloudflare, eSentire, and law enforcement across six countries — seized 330 domains and dismantled the core infrastructure of Tycoon2FA, the Phishing-as-a-Service (PhaaS) platform responsible for an estimated 62% of all adversary-in-the-middle (AiTM) phishing attacks blocked by Microsoft in early 2026 — over 30 million malicious emails per month.

Campaign volume dropped to 25% of normal levels on March 4 and 5. Within days, it returned to baseline.

This report analyzes what happened between takedown day and today, why it happened, and what it means for defenders. The short answer: seizing infrastructure disrupts operations; it does not destroy platforms. Tycoon2FA's cryptographic fingerprint, codebase, and subscriber network survived intact. The 330 domains were disposable.

Latest development (May 2026): Tycoon2FA has integrated OAuth 2.0 Device Code phishing — abusing Microsoft's legitimate Device Authorization Grant flow to compromise Microsoft 365 accounts without stealing passwords or bypassing MFA in the traditional sense. Victims authenticate on genuine Microsoft infrastructure, unknowingly granting OAuth tokens to attacker-controlled devices.

---

Background: What Tycoon2FA Is and Why It Mattered

Platform Overview

Tycoon2FA emerged around August 2023 as a full-service PhaaS platform — not a kit that attackers deploy themselves, but a subscription service offering infrastructure, campaign management panels, and real-time MFA interception as a service to approximately 2,000 subscribers and thousands of downstream criminals.

Microsoft tracks the primary operator as Storm-1747. Civil proceedings filed by Microsoft and Health-ISAC name an individual suspect as Saad Fridi.

Platform timeline:

• 2023: Initial emergence; focus on Microsoft 365 AiTM phishing
• Mid-2025: Accounts for 62% of AiTM phishing blocked by Microsoft; exceeds 30M emails/month
• Late 2025: Hybridization with Salty 2FA observed
• Jan–Feb 2026: Campaign surge with new TLDs and hybrid kits
• March 4, 2026: Europol/Microsoft takedown; 330 domains seized across Latvia, Lithuania, Portugal, Poland, Spain, UK
• Same day: Operators begin rebuilding (per CrowdStrike)
• March 24, 2026: New campaign confirmed active from fresh Russian infrastructure
• April 2026: Returns to pre-disruption activity levels
• May 2026: Device code phishing capability integrated Targeted sectors across the platform's operational history: education, healthcare, finance, government, non-profit. The platform's AiTM capability allowed operators and subscribers alike to bypass traditional MFA — not by breaking cryptography, but by sitting in the middle of a legitimate authentication session and stealing session cookies in real time.

---

Technical Analysis: The Seven-Stage Post-Takedown Attack Chain

Abnormal AI confirmed a new Tycoon2FA campaign active on April 2, 2026 — 20 days after the takedown — operating from freshly registered Russian infrastructure. The following is a complete technical breakdown of the rebuilt chain.

Stage 1: AWS S3-Hosted Lure Page

The attack opens with a cloned Microsoft Power Pages portal hosted on an AWS S3 bucket, impersonating a OneDrive file-sharing notification: a procurement lure framed as "RFQ/#PO Enquiry - Microsoft Spreadsheet."

The template (Power Pages v9.7.3.10) was cloned from a legitimate Azure tenant provisioned in the Saudi Arabia region, carrying authentic Microsoft framework code, telemetry scripts, and styling. A setTimeout fires after 3 seconds, redirecting to Stage 2.

Why S3: S3 bucket URLs carry AWS's domain reputation, bypassing URL reputation checks that would flag a freshly registered domain.

Stage 2: Nulled Link Management Platform

The redirect lands on a 66biolinks instance — a commercial link management platform (AltumCode product) running as a pirated copy on attacker-controlled infrastructure. This layer serves dual purpose: an additional redirect hop that obscures the final destination from email gateway URL scanners, and campaign tracking/analytics for the operator.

Infrastructure: LiteSpeed + CyberPanel on IPXO-leased IP (212.81.47.99), fronted by Cloudflare.

Stage 3: IP Blocklist Gate

Before any phishing content is displayed, JavaScript queries ipinfo[.]io to check the visitor's IP organization. Matches against a hardcoded list of 16 cloud and hosting providers result in redirect to rotating legitimate ecommerce platforms (Volusion, PrestaShop, Ecwid, Square).

Evasion technique: provider names are stored reversed (e.g., "etatssewa" instead of "awsstate") to defeat static string scanning.

Stage 4: Dual Fake CAPTCHA Gates

Visitors that pass the IP filter encounter a "Human Check" gate — two sequential fake CAPTCHAs, one on the link management platform and one on the credential harvesting domain (criopiochio[.]ru).

Both gates share identical UX but use polymorphic CSS class names (Gate 1: .r0, .w2, .of4; Gate 2: .o0, .f7, .ru2). Form IDs, checkbox IDs, and variable names differ between renders — visually identical to a human visitor, entirely distinct to signature-based detection tools.

The hidden form uses HTML entity obfuscation: method="POST" decodes to POST. On submission, Gate 1 sends a 301 redirect to criopiochio[.]ru; Gate 2 triggers the encrypted payload.

Stage 5: Encrypted Payload — The Stable Cryptographic Fingerprint

After the second CAPTCHA, the server returns an obfuscated JavaScript payload encrypted with a Caesar+XOR cipher seeded by a Linear Congruential Generator (LCG). This is Tycoon2FA's most reliable detection signature:

LCG constants: multiplier=9301, increment=49297, modulus=233280
Payload format: base64_payload : seed_integer : base64_key

Decryption chain:

1. Generate XOR keystream via PRNG seeded with seed + decoded_key[0]
2. Generate Caesar shift values via PRNG seeded with seed + 99
3. Reverse Caesar cipher on alphabetic characters using per-position shift values
4. XOR each byte against the corresponding keystream byte
5. Execute via eval Critical finding: These LCG constants are identical across every observed Tycoon2FA deployment — including confirmed pre-takedown domains (freasiju[.]ru, edistolygrag[.]ru) and this post-takedown campaign. Infrastructure changes. The cryptographic fingerprint does not. This is the platform's exploitable weakness: a stable detection signal that persists regardless of how many times operators rebuild.

New in post-takedown variants: eval is invoked indirectly via frames["eval"] through a Symbol.toPrimitive trick. The string "eval" is extracted from invalid CSS color-like values (#e64D00 → 'e', #v05235 → 'v', #a0B100 → 'a', #l2C3D4 → 'l'). The string atob is constructed via XOR: [0x63, 0x66, 0x61, 0x66] XOR [0x02, 0x12, 0x0e, 0x04].

Stage 6: Active Counter-Analysis Suite

The decrypted payload runs an extensive anti-analysis suite before any credential harvesting:

Technique	Mechanism
Automation detection	Checks navigator.webdriver, window.callPhantom, window._phantom, "Burp" in user agent → redirects to about:blank
DevTools blocking	Suppresses all developer tool keyboard shortcuts (F12, Ctrl+U, Ctrl+Shift+I/C/J/K, Cmd+Alt+I/C); disables right-click
Debugger trap	setInterval fires debugger every 100ms; if DevTools is open, the pause is detected via performance.now() timing → redirect to ecommerce decoy
Platform blocking	Blanks the page entirely with document.write("") on Linux desktops (excluding Android), specifically targeting analyst workstations

Domain-level deception: Every route on the phishing domain returns a different AI-generated fake website depending on how it is accessed. URL scanners and reputation services probing the domain see entirely benign content.

The shift from 1000ms to 100ms debugger interval (compared to pre-takedown samples) signals an intentional hardening of the anti-analysis capability in response to the disruption.

Stage 7: Kill Switch and Credential Harvesting

Before rendering the credential harvester, the payload sends a GET request to a C2 kill switch. Response "0" → campaign active; any other response → redirect to a benign site.

Kill switch domains: founiodrai[.]digital and ziostohou[.]digital, hosted on BunnyCDN (84.17.63.178). This is a direct response to the March 4 takedown which targeted Cloudflare-hosted infrastructure — operators migrated their CDN provider to reduce single-point-of-failure risk for future disruption attempts.

When the kill switch confirms active status, JavaScript POSTs to a randomized endpoint with parameters bltpg (campaign/page identifier) and sid (per-session token). The server responds with {"status":"success"} and the page delivers the AiTM credential harvesting relay — a real-time proxy to the legitimate Microsoft login flow, capturing credentials and session tokens as the victim authenticates.

---

May 2026 Update: Device Code Phishing — Compromising Accounts Without Stealing Passwords

eSentire's Threat Response Unit (TRU) analyzed a late April 2026 Tycoon2FA campaign integrating OAuth 2.0 Device Authorization Grant flow abuse — commonly called device code phishing.

How OAuth Device Code Flow Works (and How It's Being Abused)

Microsoft's Device Authorization Grant was designed for devices with limited input capability — smart TVs, IoT devices, conference room systems, printers. The flow works by having the device display a user code and directing the user to authenticate at microsoft.com/devicelogin from a separate device.

Tycoon2FA's abuse of this flow:

1. Attacker initiates Device Authorization Request to Microsoft
   → Microsoft returns: device_code + user_code + verification_uri
   
2. Lure email sent to victim (Microsoft 365 voicemail notification)
   → Contains user_code + link to microsoft.com/devicelogin
   
3. Victim visits microsoft.com/devicelogin (LEGITIMATE Microsoft domain)
   → Enters user_code; MFA is triggered and completed normally
   
4. Microsoft issues OAuth access token + refresh token
   → Token granted to device_code CONTROLLED BY THE ATTACKER
   
5. Attacker has full Microsoft 365 access for the victim's account
   → No password stolen; MFA completed legitimately

Why this is particularly dangerous: The victim interacts with the real microsoft.com. MFA is completed correctly. Nothing in the user's experience indicates compromise. The phish doesn't bypass MFA — it changes what MFA is authorizing.

Delivery mechanism: Lure emails use Trustifi click-tracking URLs — Trustifi is a legitimate email security platform, and its domains carry good sender reputation with most email gateways. From that initial click, victims pass through a four-layer delivery chain carrying the full Tycoon2FA tradecraft before reaching the device code entry page.

This technique is not unique to Tycoon2FA in May 2026. Kali365 (a new PhaaS platform that emerged on Telegram in April 2026) and EvilTokens are also adopting device code phishing. This is becoming a standard PhaaS capability, not a single-actor innovation.

---

IOC & Infrastructure

# Kill Switch Domains (post-takedown)
founiodrai[.]digital      → BunnyCDN (84.17.63.178)
ziostohou[.]digital       → BunnyCDN (84.17.63.178)
 
# Credential Harvesting Domain
criopiochio[.]ru
 
# Pre-takedown domains (cryptographic fingerprint reference)
freasiju[.]ru
edistolygrag[.]ru
 
# Link Management Layer
212.81.47.99              → IPXO-leased, LiteSpeed/CyberPanel, Cloudflare-fronted
 
# Tycoon2FA Kit Parameters (stable across all campaigns)
bltpg                     → Campaign/page identifier (POST parameter)
sid                       → Per-session token
 
# LCG Cryptographic Fingerprint (unchanged across all deployments)
multiplier: 9301
increment: 49297
modulus: 233280
 
# Trustifi click-tracking (legitimate platform abused for delivery)
Prefix: track.trustifi.com (legitimate domain; flag when redirecting to phishing chain)

---

MITRE ATT&CK Mapping

Phase	Technique ID	Technique Name	Details
Initial Access	T1566.002	Phishing: Spearphishing Link	Lure email with Trustifi tracking URL
Credential Access	T1557	Adversary-in-the-Middle	AiTM relay — capture credentials + session cookies in real time
Credential Access	T1528	Steal Application Access Token	OAuth device code flow abuse — steal access + refresh tokens
Defense Evasion	T1027	Obfuscated Files or Information	Caesar+XOR+LCG encryption, polymorphic CSS, reversed strings
Defense Evasion	T1036	Masquerading	Clone Microsoft Power Pages, OneDrive notification impersonation
Defense Evasion	T1497	Virtualization/Sandbox Evasion	navigator.webdriver check, 100ms debugger trap, Linux platform block
Defense Evasion	T1583.008	Acquire Infrastructure	AWS S3 lure page, BunnyCDN kill switch to avoid single-provider takedown risk
Collection	T1539	Steal Web Session Cookie	Session cookie capture via AiTM relay
Persistence	T1078	Valid Accounts	Stolen credentials/tokens for persistent access

---

Detection Rules

KQL (Microsoft Sentinel) — Device Code Phishing

// Detect OAuth Device Code sign-ins from unusual context
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| where ResultType == 0  // Successful sign-in
| where NetworkLocationDetails == "[]"  // No trusted network location
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
    AppDisplayName, AuthenticationProtocol, DeviceDetail, UserAgent
 
// Hunt Tycoon2FA kill switch domain lookups
DnsEvents
| where Name in ("founiodrai.digital", "ziostohou.digital", "criopiochio.ru")
| project TimeGenerated, Computer, ClientIP, Name, IPAddresses
 
// Detect POST with Tycoon2FA bltpg kit parameter
CommonSecurityLog
| where RequestURL contains "bltpg="
| where RequestMethod == "POST"
| project TimeGenerated, SourceIP, DestinationHostname, RequestURL
 
// Correlate Device Code sign-in with prior inbound email (phishing sequence)
let DeviceCodeEvents = SigninLogs
    | where AuthenticationProtocol == "deviceCode" and ResultType == 0
    | project UserId, UserPrincipalName, SignInTime = TimeGenerated;
EmailEvents
| where EmailDirection == "Inbound"
| join kind=inner DeviceCodeEvents on \(left.RecipientObjectId == \)right.UserId
| where SignInTime between (TimeGenerated .. datetime_add('hour', 2, TimeGenerated))
| project EmailTime = TimeGenerated, SignInTime, UserPrincipalName, 
    SenderAddress, Subject, UrlCount

KQL — AiTM Session Token Replay Detection

// Detect session token used from a different IP than initial authentication
let InitialAuth = SigninLogs
    | where ResultType == 0
    | project UserId, CorrelationId, InitialIP = IPAddress, InitialTime = TimeGenerated;
SigninLogs
| where ResultType == 0
| join kind=inner InitialAuth on UserId, CorrelationId
| where IPAddress != InitialIP
| where TimeGenerated > InitialTime
| project TimeGenerated, UserPrincipalName,
    OriginalIP = InitialIP, ReplayIP = IPAddress,
    MinutesDelta = datetime_diff('minute', TimeGenerated, InitialTime)
| where MinutesDelta < 60

Sigma Rule — Tycoon2FA LCG Fingerprint

title: Tycoon2FA LCG Cryptographic Constants in Web Traffic
id: t2fa-001-lcg-constants
status: experimental
description: >
  Detects Tycoon2FA's stable LCG constants (9301/49297/233280) in proxy traffic.
  These constants have remained unchanged across all observed deployments,
  including pre- and post-March 2026 takedown variants.
author: SOC Team
date: 2026/05/26
references:
  - https://abnormal.ai/blog/tycoon2fa-post-takedown-rebuild
logsource:
  category: proxy
detection:
  selection_param:
    c-uri-query|contains: 'bltpg'
  condition: selection_param
falsepositives:
  - None expected (bltpg is Tycoon2FA-specific)
level: high
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1528
  - attack.defense_evasion
  - attack.t1027

---

Expert Assessment

On the failure mode of infrastructure-only takedowns:

The March 2026 operation was large in scale — 330 domains across six jurisdictions, coordinated by Europol under the CIEP framework. The result was a 75% reduction in campaign volume for exactly two days. This is not a criticism of the operation; it is a description of how mature PhaaS platforms are architected.

Tycoon2FA's operational value does not live in its domains. It lives in its LCG constants, its seven-stage delivery chain, its subscriber base, and the operational knowledge of its 2,000 customers. The March 4 operation successfully disrupted Cloudflare-hosted infrastructure. Operators responded by migrating kill switch infrastructure to BunnyCDN and registered fresh domains. Total adaptation time: less than three weeks to full operational recovery.

On device code phishing as a category shift:

AiTM phishing in its traditional form requires the victim to interact with a convincing fake login page. Defenders can train users to check URLs, deploy anti-phishing browser extensions, or use FIDO2/passkey authentication to make credential theft irrelevant.

Device code phishing eliminates the fake page entirely. The victim visits microsoft.com. They enter a real code. MFA fires and completes. Nothing in their experience signals compromise. The attack vector is now socially engineered OAuth consent, not credential theft. This requires a fundamentally different defensive response.

The fact that Kali365 and EvilTokens — both emerging in 2026 — have also adopted device code phishing confirms this is a category-level shift in PhaaS capability, not a Tycoon2FA-specific innovation.

On the stable cryptographic fingerprint:

The LCG constants (9301 / 49297 / 233280) represent Tycoon2FA's single greatest operational weakness. Across every known variant, every infrastructure generation, every post-takedown rebuild — these constants remain unchanged. As long as operators maintain backward compatibility in their kit, defenders have a reliable cross-infrastructure detection signal. The bltpg POST parameter serves the same function: a stable artifact that persists through infrastructure rotations.

Defenders should anchor detection on these stable signals, not on IOCs (domains, IPs) that change with every rebuild cycle.

---

Recommendations

Immediate (0–24h)

• Restrict OAuth Device Code flow in Conditional Access if there's no legitimate business need:

  Azure AD → Conditional Access → New Policy
  Users: All users | Cloud apps: All cloud apps
  Conditions: Authentication flows → Device code flow → Yes
  Grant: Block
  

• Block known IOCs — domains founiodrai[.]digital, ziostohou[.]digital, criopiochio[.]ru at DNS/proxy/firewall layer.
• Hunt bltpg= in proxy/WAF logs — POST requests containing this parameter are Tycoon2FA-specific. No legitimate application uses this parameter.

Short-term (1–7 days)

• Deploy the KQL detection rules for device code phishing, AiTM session replay, and the kill switch domain hunt into Sentinel.
• Enable Token Protection (Token Binding) for Microsoft 365 — prevents captured tokens from being replayed from a different device or location.
• Audit Sign-in Logs for authenticationProtocol == "deviceCode" over the past 30 days — investigate any device code authentication that followed an inbound email from an unknown sender.
• User awareness update: Specifically train users on device code phishing lures — the voicemail notification template, the instruction to visit microsoft.com/devicelogin, and why they should verify what they're authorizing before entering any device code.

Long-term

• Zero Trust authentication posture: Move toward treating every authentication flow — including Microsoft's "legitimate" ones — as requiring context validation. Device code authentication from an unmanaged device in an unusual location should require step-up verification.
• Build stable-signal detection, not IOC-chasing: Anchor SIEM rules on the LCG constants and bltpg parameter, not on domain or IP-based IOCs that rotate with each infrastructure rebuild.
• Periodic threat hunt hypothesis: "Did any user perform a device code authentication within two hours of clicking an external email link?" Run this hunt monthly.

---

References

1. Abnormal AI — Tycoon2FA Rebounds Post-Takedown with 6 Layers of Obfuscation
2. BleepingComputer — Europol-coordinated action disrupts Tycoon2FA phishing platform
3. BleepingComputer — Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
4. BleepingComputer — Tycoon2FA phishing platform returns after recent police disruption
5. eSentire TRU — Tycoon 2FA Operators Adopt OAuth Device Code Phishing
6. Microsoft On the Issues — How a global coalition disrupted Tycoon 2FA