Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Collection of Microsoft Security Blog posts describing multiple high-impact threats and operational guidance. Highlights include: disruption of Tycoon2FA, a large AiTM phishing‑as‑a‑service platform that targeted >500,000 organizations monthly; signed malware using a stolen EV certificate to deploy legitimate RMM tools for persistent access; OAuth redirection abuse to weaponize trusted auth flows for phishing and malware delivery; developer‑targeting via malicious Next.js repositories that trigger RCE→C2 through normal build workflows; and guidance on AI threat modeling, agent/OpenClaw runtime