Tycoon2FA’s use of Microsoft 365 device-code phishing shows how attackers are adapting to bypass traditional MFA expectations without needing to steal passwords directly. By tricking users into entering an attacker-generated code on Microsoft’s legitimate device-login page, the victim unknowingly grants OAuth tokens to an attacker-controlled device, allowing access to email, calendars, and cloud files. This makes the attack particularly dangerous because the login experience appears legitimate to the user.

Organizations should disable OAuth device-code flow where it is not required, restrict OAuth consent, require admin approval for third-party apps, enable Continuous Access Evaluation, and enforce compliant-device access policies. Security teams should also monitor Entra logs for deviceCode authentication, Microsoft Authentication Broker usage, and unusual Node.js user agents. MFA is still important, but this incident proves once again that attackers do not always break controls; sometimes they just convince users to authorize the attacker’s device themselves. Humanity, as usual, remains the most generously documented vulnerability class.

The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. [...]

Source: Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing via Bleeping Computer — published 17 May 2026.