Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Real-time phishing and vishing let attackers proxy a live login, satisfy MFA, and inherit valid SSO sessions without breaking the authentication stack, according to Trusona's analysis of Tycoon 2FA, Microsoft, Europol, and public advisory data. The real failure is not MFA itself but the assumption that authentication proves consent and that help-desk workflows can safely trust a logged-in session.
NHIMG editorial — based on content published by Trusona: Blog Vishing and Real Time Phishing Kits: A New Age of SSO Bypass
By the numbers:
- In March 2026, Europol coordinated a global takedown of Tycoon 2FA after the platform had sent tens of millions of phishing messages each month.
- By mid-2025, Tycoon 2FA accounted for 62% of all phishing attempts blocked by Microsoft.
- The Canadian Centre for Cyber Security analyzed over 100 AiTM phishing campaigns targeting Microsoft Entra ID accounts between 2023 and early 2025.
Questions worth separating out
Q: What breaks when MFA is present but the login can still be relayed in real time?
A: MFA stops simple credential replay, but it does not stop an attacker who can proxy the live login flow and inherit the resulting session.
Q: Why do AiTM phishing attacks remain effective against SSO environments?
A: Because they target the authenticated session, not only the password.
Q: How should security teams reduce help desk account takeover risk?
A: Treat account recovery as a privileged identity workflow, not a support convenience.
Practitioner guidance
- Move high-risk actions out of standard login trust Require separate verification for password resets, MFA enrollment, device registration, token creation, and recovery-data changes.
- Adopt phishing-resistant authentication for exposed populations Prioritise passkeys or FIDO2-style controls for administrators, finance users, and help-desk personnel who can approve privileged changes.
- Treat support workflows as privileged identity events Build step-up checks for help-desk actions that alter account state, and verify the requester through a channel that cannot be satisfied by a voice call or proxied session.
What's in the full article
Trusona's full analysis covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of how Tycoon 2FA-style relay infrastructure proxies the login flow.
- Source references and campaign context for the Europol takedown, Microsoft reporting, and the Canadian Centre for Cyber Security findings.
- More detail on the help-desk impersonation patterns used by Scattered Spider and similar groups.
- The article's own defensive framing for phishing-resistant verification and post-authentication controls.
👉 Read Trusona's analysis of real-time phishing and SSO bypass →
Real-time phishing and vishing: are your SSO controls enough?
Explore further
25/08/2026 6:11 pm
Authentication without consent is the core failure exposed by real-time phishing. MFA can confirm that a user satisfied a challenge, but it cannot confirm that the resulting session is being used by the person who intended it. That gap is why AiTM attacks succeed even when identity systems behave exactly as designed. Practitioners should stop treating successful login as proof of safe access.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when identity recovery is abused for account takeover?
A: Accountability typically spans IAM owners, help desk operations, and security governance because the failure sits in the recovery process, not only in the login method. If reset workflows are weak, the organisation owns that control gap and must govern it as part of identity assurance.
👉 Read our full editorial: Real-time phishing bypasses SSO by exploiting human workflow
