Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
#Tycoon2FA
https://www.elastic.co/security-labs/tycoon-2fa-aitm-detection-engineering
Tycoon 2FA AiTM detection for Entra ID and Google — Elastic Security Labs

Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints, ship detection rules, and contain incidents in under 10 seconds.