Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
2026-05-17T19:23:31Z•9a67e699739808b73f105d81bd87e5959f7d3b237c9ac07eb142785e92866eac
Avada BuilderAzureAzure Backup for AKSBurst StatisticsEdgeExchangeFunnel BuilderKazuar','Secret Blizzard'MicrosoftOpenAIPyPITanStackTrustifiTycoon2FAWindows-driver-rollbackWooCommerceWordPresscredit-card-theftdevice-code-phishingnode-ipcnpmpasswords-in-memoryphishingsupply-chainzero-day
What happened
A cluster of active, high-impact security incidents: the Tycoon2FA phishing kit now supports device-code phishing and abuses Trustifi click-tracking to hijack Microsoft 365 accounts. Microsoft-related issues include a disputed silent fix for an Azure Backup for AKS bug (no CVE issued) and an Exchange zero-day exploited in the wild; Microsoft also announced Edge will stop loading cleartext passwords into memory and added remote rollback for faulty Windows drivers. Multiple WordPress plugin flaws (Funnel Builder, Avada Builder, Burst Statistics) are being actively exploited to steal credentials/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 9a67e699739808b73f105d81bd87e5959f7d3b237c9ac07eb142785e92866eac
- Enrichment time
- 2026-05-17T19:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.