how it happened
- whophishing kitsold as a service
- the gaprelay proxypasses MFA to the real site
- thensession tokenvalid until it expires
- the resultindustrial scale~39,000 token thefts a day
what everyone assumed
MFA was bought to end the phishing problem, and the rollout was real work that earned its confidence. With a second factor on every account, a stolen password is half a key. The reasonable conclusion is that phishing emails became someone else’s problem.
what happened
Tycoon2FA and kits like it run as subscription services, relaying real logins at industrial scale and harvesting the session tokens that finished authentication produces. Across the ecosystem, Microsoft estimated roughly 39,000 token theft incidents per day (2024). Each stolen session rode quietly inside its expiry window, indistinguishable from the user.
step by step
- a kit sold as a subscription relays real loginsThe user completes MFA on a proxy page.
- the session token is harvestedIt rides inside its expiry window, indistinguishable from the user.the assumption breaks here
- 2024about 39,000 token thefts a dayMicrosoft's estimate across the ecosystem.
- March 2026Microsoft publishes its teardown
how it surfaced
Microsoft published its teardown of the operation in March 2026, describing a leading adversary-in-the-middle kit run at scale. By then the pattern had a name and a market, and the defense had a clear shape: factors that cannot be relayed.
Prompt-and-code MFA stops the password thief, and the market answered with the session thief.
The factor that holds is bound to the genuine domain, which a relay page cannot satisfy.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA criminal service steals the logged-in session as it happens.what it costs youThe attacker stays logged in as your admin, and the code did not help.
- or it goes like thisit happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- or it goes like thisit happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
sources
your turn
what you can do about it
this week
Check which second factor your admin accounts actually use.
Your admins' MFA factor is either relayable or it is not, and that single property decides whether this entire criminal economy applies to you. Checking which factors your highest-privilege accounts actually use takes less time than reading this story.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →