Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace

Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.

Summary from Elastic Security Labs.

Explained

The technology and terms in this story. Learn more

More in Identity

Cloudflare & Ping Identity: Identity Security in the Era of AI

VideoCloudflare2d agoIdentityAI

Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

Microsoft Security Blog2d agoAppSecIdentity

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

The Hacker News2d agoThreat IntelNetworkIdentity

Infostealer riding the AI Train

Check Point Research2d agoThreat IntelIdentityAI

Microsoft 365 accounts compromised at 79 organizations, no passwords needed

Help Net Security2d agoCloudIdentity