# Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace

DevFeed: [Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace](<https://devfeed.tech/articles/detecting-tycoon-2fa-aitm-attacks-across-entra-id-and-google-workspace-49126.md>)

Original publisher: [Read original article](<https://www.elastic.co/security-labs/threat-command/tycoon-2fa-aitm-detection-engineering>)

Author: Samir Bousseaden,Terrance DeJesus

Published: 2026-05-26T00:00:00Z

Content type: article

Language: en

Sources: [Elastic Security Labs](<https://devfeed.tech/sources/elastic-security-labs.md>)

Topics: [Adversary-in-the-middle (AiTM)](<https://devfeed.tech/topics/adversary-in-the-middle-aitm.md>), [Entra ID](<https://devfeed.tech/topics/entra-id.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Google](<https://devfeed.tech/topics/google.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Security Information and Event Management (SIEM)](<https://devfeed.tech/topics/siem-security.md>), [High Profile Threats](<https://devfeed.tech/topics/high-profile-threats.md>), [proxy](<https://devfeed.tech/topics/proxy.md>), [microsoft 365](<https://devfeed.tech/topics/microsoft-365.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [code](<https://devfeed.tech/tags/code.md>), [detection-engineering](<https://devfeed.tech/tags/detection-engineering.md>), [email](<https://devfeed.tech/tags/email.md>), [entra-id](<https://devfeed.tech/tags/entra-id.md>), [google-workspace](<https://devfeed.tech/tags/google-workspace.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [microsoft-365](<https://devfeed.tech/tags/microsoft-365.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [qr-code](<https://devfeed.tech/tags/qr-code.md>), [target](<https://devfeed.tech/tags/target.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>)

## AI overview

Elastic describes how the Tycoon 2FA phishing-as-a-service platform uses adversary-in-the-middle reverse proxies to bypass MFA and steal authenticated session tokens from Entra ID and Google Workspace accounts. The article maps telemetry across both platforms and presents detection and containment workflows.

## Source excerpt

Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.