Tycoon 2FA AiTM detection for Entra ID and Google — Elastic Security Labs

Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints, ship detection rules, and contain incidents in under 10 seconds.