Skip to content
Threat Feed

Vendor

Trustifi

1 brief RSS
high advisory

Tycoon2FA Phishing Kit Targets Microsoft 365 Accounts with Device-Code Phishing

The Tycoon2FA phishing kit now supports device-code phishing attacks targeting Microsoft 365 accounts, abusing Trustifi click-tracking URLs, redirecting victims through Cloudflare Workers to a fake Microsoft CAPTCHA page, tricking them into entering a device code, and granting attackers OAuth tokens and access to their Microsoft 365 accounts.

Microsoft 365 +2 phishing device-code phishing oauth tycoon2fa
2r 2t