Tycoon2FA again bypasses multi-factor authentication through device-code phishing

Tycoon2FA now supports phishing attacks using the OAuth 2.0 device authorization flow to hijack Microsoft 365 accounts. Victims are routed through a Trustifi tracking URL, Cloudflare Workers, and JavaScript layers to a fake Microsoft CAPTCHA page and are tricked into entering a code supplied by the attacker at microsoft.com/devicelogin.