Anatomy of Tycoon 2FA Phishing: Tactics Targeting M365 and Gmail

The Tycoon 2FA phishing kit is described as one of the most sophisticated threats targeting enterprise environments, a Phishing-as-a-Service platform that emerged in August 2023 and uses adversary-in-the-middle techniques to bypass multi-factor authentication. According to Any[.]run malware trends tracker, Tycoon 2FA leads with over 64,000 reported incidents this year, targeting Microsoft 365 and Gmail deployments.

The campaign relies on a reverse proxy that hosts deceptive pages mimicking legitimate logins, capturing credentials and session cookies in real time and updating the login page dynamically based on responses from Microsoft servers. Phishing links are distributed through PDFs, SVG files, PowerPoint presentations, emails and malicious websites, with attackers also hosting fake pages on Amazon S3 and leveraging Canva and Dropbox for credential harvesting.

In real time the attacker relays the MFA request to Microsoft’s servers, enabling a man-in-the-middle bypass of MFA, while the final payload collects system information and geolocation data for exfiltration. The piece urges organisations using Microsoft 365 and Gmail to review conditional access policies and promote credentials‑hunting awareness alongside passwordless authentication strategies. November 4, 2025.