Phishing Bypasses MFA in 2026: AiTM, Device-Code & GenAI Threats

Phishing in 2026 is an efficiency game, not a volume game. Generative AI has eliminated the grammar errors that once flagged lures, while adversary-in-the-middle (AiTM) proxy kits and device-code abuse techniques now relay real MFA prompts and steal live session tokens. This shift means that multi-factor authentication, long considered a reliable last line of defense, is now routinely bypassed. Attackers are no longer trying to crack your credentials; they are waiting for you to authenticate and then hijacking your authenticated session. This reality demands a fundamental shift in defense strategy from perimeter denial to post-authentication containment.

How This Was Researched

This analysis synthesizes primary-source threat intelligence reports, law enforcement seizure announcements, and vendor telemetry published between Q4 2025 and Q2 2026. Every statistic is sourced to an HTTP-200-verified URL. This analysis is based on official documentation and published reports — we did not run hands-on tests. Last researched: August 2026.

Why Has Phishing Become an Efficiency Game in 2026?

GenAI has collapsed lure-production costs, generating grammatically perfect, brand-consistent pages with role-specific context at scale, while AiTM proxy kits relay real MFA completions in real time. MFA has turned from a hard stop into a speed bump that sophisticated attackers drive through in seconds, explaining the paradox of lower volume but higher success rates.

The efficacy of AI-driven phishing is stark. Microsoft’s Digital Defense Report 2025 states that AI-driven phishing is approximately 3x more effective than traditional campaigns. This efficiency is reflected in user behavior: Hoxhunt measured a 14x end-of-year surge in AI-generated phishing that bypassed filters, with the share of all reported attacks rising from 4% to 56% across the December 2025 holiday season and holding into 2026.

Meanwhile, Zscaler ThreatLabz telemetry counted 413,524 AI-generated site instances, with 9.06% (37,447 instances) flagged as malicious. Attributed builders included Manus AI (15.6%), Blackbox AI (14.3%), and Anything AI (9.8%). Paradoxically, Zscaler also observed that overall phishing volume fell ~20% year-over-year in both 2024 and 2025, proving the shift is from high-volume “spray and pray” to high-effectiveness, targeted operations.

What Does the 2026 Phishing Kill Chain Look Like?

The kill chain begins with a PhaaS kit like Tycoon 2FA, EvilTokens, or ARToken and a lookalike domain configured with an AiTM reverse proxy or device-code flow. Victims lured via email, QR code, or vishing complete a real MFA prompt into the proxy, which relays it and steals the session cookie; device-code flows hand over a valid token instead.

For example, the EvilTokens kit documented by Huntress hit 344 organizations across five countries in just 16 days during March 2026. Critically, these phishing emails passed untouched through Cisco, Trend Micro, and Mimecast filters because the lure contained a legitimate Microsoft device-code URL, leaving no malicious artifact for signature-based detection. The attacker’s persistence is then established not through a stolen password, but through the legitimate session token handed over by the victim.

How Are GenAI Tools Fueling Phishing at Scale?

GenAI tools have weaponized phishing by automating convincing, personalized content. An LLM can write a role-specific email that mirrors a victim’s workflow, draft follow-on wire-fraud messages in the victim’s own voice minutes after token capture, and generate an entire lookalike portal in minutes. This collapses what once required skilled social engineering into an automated, scalable process.

The operational impact is significant. Zscaler’s data shows that 95.2% of all phishing activity is now delivered over encrypted (TLS) channels, hiding credential theft and redirects within normal-looking web traffic. This encryption, combined with AI-generated content, makes traditional signature-based email filtering increasingly ineffective. The services industry, for instance, saw a 65.5% year-over-year increase in phishing targeting, with billing, renewals, and document exchange used as lure cover. Attackers increasingly target AI-assisted workflows, so defenders should apply the hardening guidance in securing the AI stack.

What Is Tycoon 2FA and Why Did It Dominate?

Tycoon 2FA is an AiTM proxy PhaaS kit that accounted for approximately 62% of all phishing attempts Microsoft blocked by mid-2025, processing over 30 million malicious emails monthly and reaching 500,000 organizations. Priced at $120 for 10 days or $350 per month, it has been linked to roughly 96,000 victims since 2023, including over 55,000 Microsoft customers.

The real-world impact has been severe. A March 4, 2026, global takedown led by Microsoft’s Digital Crimes Unit and Europol seized 330 Tycoon 2FA domains. Researchers documented that 100+ Health-ISAC members were successfully phished, and in New York alone, the campaign hit two hospitals, six municipal schools, and three universities. Despite this major law enforcement action, capabilities similar to Tycoon 2FA are proliferating across successor kits like EvilTokens and ARToken.

How Do Device-Code Phishing Kits Evade Traditional Defenses?

Device-code phishing kits abuse the legitimate OAuth device authorization flow. The EvilTokens PhaaS kit, priced at $1,500 plus $500 per month, gives the victim a legitimate Microsoft device code instead of stealing a password and relaying an MFA prompt. The victim completes a real login and hands over a valid session token; no password or MFA credential is ever compromised.

This technique is devastatingly effective because it leaves no artifact for email security gateways to scan. The Huntress research found that EvilTokens phishing passed untouched through Cisco, Trend Micro, and Mimecast filters. In a 16-day window in March 2026, the operation hit 344 organizations across five countries. The kit then uses AI to generate role-specific lures and automate wire-fraud follow-ups in the victim’s own voice within minutes of token capture. The ARToken kit, tracked by Cisco Talos, combines similar device-code abuse with PRT (Primary Refresh Token) panel access for persistent, replay-resistant access. OAuth token abuse also threatens AI agent tooling — see our companion post on MCP security.

How Does BlackFile Vishing Combine Voice and Real-Time MFA Relay?

Google Threat Intelligence-tracked UNC6671 uses a ‘BlackFile’ vishing and extortion operation that combines voice phishing with real-time AiTM. Attackers call employees on their personal phones, posing as IT support conducting a ‘mandatory passkey migration.’ They steer victims to lookalike SSO portals (e.g., org.passkeyms[.]com), relay credentials and MFA prompts in real time, and register an attacker-controlled MFA device for persistent access.

This method enables sophisticated follow-on actions. In one documented case, attackers used the hijacked session to script exfiltration via Microsoft Graph and PowerShell, downloading over one million files from SharePoint and OneDrive. Extortion demands began in the millions and were later dropped to low six-figure sums. The attack is harder to detect than email phishing because it originates from a personal phone call, bypassing corporate email controls entirely, and the initial portal access is a legitimate Microsoft login.

Tycoon 2FA vs. EvilTokens vs. ARToken — How Do the Kits Compare?

The three dominant 2026 PhaaS kits use fundamentally different MFA-bypass techniques. Tycoon 2FA relies on AiTM proxy interception, EvilTokens exploits OAuth device-code flows with AI-generated lures, and ARToken combines device-code abuse with PRT panel access. Pricing, scale, and detection signals differ significantly across all three, requiring SOC teams to employ different monitoring strategies for each threat.

PhaaS Kit Comparison: Tycoon 2FA vs. EvilTokens vs. ARToken

Kit Name	Primary Technique	MFA Bypass Method	Price	Scale (documented)	Detection Signals	Key Limitation for Defenders
Tycoon 2FA	AiTM proxy	Relays real MFA prompt through attacker-controlled proxy; steals session cookie after user completes legitimate authentication.	$120/10 days or $350/month	~62% of Microsoft-blocked phishing (mid-2025); 30M+ emails/month; ~96k victims since 2023; 330 domains seized Mar 4, 2026.	Lookalike domains with proxy infrastructure; session cookie issued from unfamiliar IP immediately post-MFA; anomalous geographic login patterns.	Domain takedowns effective but successors regenerate rapidly.
EvilTokens	Device-code OAuth abuse + AI lures	User completes a real login via device-code flow and hands over a valid session token — no password or MFA credential is phished.	$1,500 + $500/month	344 orgs across 5 countries in 16 days (Mar 2026); passed untouched through Cisco, Trend Micro, Mimecast filters.	Device-code token issuance to unfamiliar device; no malicious email payload for gateway scanning; anomalous OAuth consent grants.	No email artifact to scan; requires identity-layer telemetry and device-code flow monitoring.
ARToken	Device-code abuse + PRT panel	Combines device-code flow with PRT token capture for persistent, replay-resistant access to cloud resources.	Not publicly documented (underground forum pricing)	Active Tycoon 2FA successor; Barracuda describes presence as “scattered everywhere.”	PRT token anomalies; unfamiliar device registrations post-authentication; Conditional Access policy gaps exploited.	Requires deep Entra ID monitoring; limited third-party detection tooling for PRT abuse.
Legacy credential phishing	Fake login page	Harvests passwords; MFA blocks most attempts unless the session is relayed.	Free–$100 per kit	Volume-based; high detection rate by email filters	Credential submission to lookalike domains; grammar errors (now AI-reduced)	Well-understood and largely mitigated by phishing-resistant MFA.
Phishing-resistant MFA (FIDO2/passkeys)	Origin-bound cryptographic challenge	Cannot be relayed by AiTM proxies or device-code flows; no credential or token exists to steal.	No cost (vendor-bundled)	Defender-controlled	No credential or token to steal; challenge bound to legitimate origin	Requires user enrollment and key/passkey lifecycle management.

Device-code kits like EvilTokens are harder to detect because they generate no malicious email payload. Detection must shift to identity-layer telemetry, monitoring for anomalous device-code token issuance and unfamiliar device registrations post-authentication. AiTM kits like Tycoon 2FA still dominate by volume because their proxy model scales easily, and their detection signals (lookalike domains, proxy infrastructure) are more familiar to network and email security tools.

What Do the 2026 Incident-Response Numbers Tell Us?

Cisco Talos Incident Response data for Q2 2026 confirms phishing’s central role: it was the initial access method in more than 50% of engagements, up from approximately 35% in Q1. Authentication abuse—including AiTM proxies, session-token theft, MFA fatigue, and self-enrolled devices—appeared in 65% of engagements, also up from 35%. Healthcare remained the most targeted vertical, at 17% of engagements.

These numbers are corroborated by Zscaler, which found the services industry saw a 65.5% year-over-year increase in phishing targeting. Proofpoint telemetry similarly observed over 3 million messages associated with Tycoon 2FA in February 2026 alone. The Microsoft Digital Defense Report 2025 notes that 28% of breaches were initiated via phishing or social engineering. This data collectively demonstrates that phishing is the dominant initial access technique for modern intrusion campaigns. Track identity-related vulnerabilities alongside these trends in our CVE hub.

What Actually Works — Mitigations That Match the Threat

The core mitigation is deploying phishing-resistant MFA. CISA identifies FIDO2/WebAuthn security keys and passkeys as the only widely available MFA class that an AiTM proxy cannot relay, because the cryptographic challenge is bound to the legitimate origin. Beyond this foundational step, effective defense requires a layered approach focused on post-authentication security.

Identity Layer: Enforce phishing-resistant MFA. Implement Conditional Access policies that assess risk at login and continuously. Establish strict session and token hygiene, including immediate revocation of sessions on suspicious activity and forced re-authentication. Restrict or disable OAuth device-code flows where not business-critical.
Email & Channel Layer: Harden email delivery with DMARC, DKIM, and SPF enforcement. Deploy policies to block or flag QR codes inside PDFs and SVG/HTML attachments. Given that 95.2% of phishing rides TLS, implement consistent TLS/SSL inspection, zero-trust browser isolation, and URL scanning of suspect links.
Detection Layer: Move beyond signature-based detection to behavior-based monitoring. Hunt for anomalous sign-ins (unusual IP ASN/hosting, device-code flows), suspicious inbox-rule creation, new MFA-device enrollment, and scripted bulk access to SharePoint/OneDrive (e.g., via PowerShell or python-requests).
Human Layer: Invest in human-risk programs that change behavior. Hoxhunt data shows this approach can yield an 87% reduction in malicious clicks and a 6x improvement in threat reporting within six months.
IR Layer: Develop assume-breach incident-response playbooks specifically for token theft. This goes beyond credential resets to include immediate revocation of all active sessions and refresh tokens, forensic audit of attacker-registered MFA devices and OAuth app consents, and analysis of data accessed using the stolen token’s scope.

The Bottom Line

Phishing in 2026 is not declining—it is concentrating. Volume is down roughly 20% year-over-year, but per-attempt effectiveness has tripled because GenAI eliminates quality tells and AiTM/device-code kits bypass MFA entirely. Proofpoint found 59% of accounts taken over in 2025 had MFA enabled. Defenders must assume every authenticated session is potentially compromised and build defenses around post-authentication control and session revocation.

For IT and security teams, the immediate action items are clear:

Audit your MFA types: Begin migrating from SMS, TOTP, and push-based MFA to FIDO2/passkeys.
Restrict device-code OAuth flows: Disable or tightly monitor the device-code authorization flow if it is not a required business function.
Implement Conditional Access with session controls: Enforce policies that evaluate sign-in risk and automatically revoke tokens for anomalous access.
Deploy behavior-based detection: Focus on identity-layer telemetry (e.g., anomalous token issuance, unfamiliar device registrations) rather than email content alone.
Tabletop a token-theft IR scenario: Run an exercise focused on detecting and responding to a hijacked session, not just a compromised password.

Frequently Asked Questions

Below are answers to the questions security teams ask most often about AiTM proxies, device-code phishing, and token-theft incident response. Each answer is grounded in the primary-source threat intelligence cited throughout this analysis, so you can verify the claims against the original vendor and government reporting.

Can AiTM proxy kits bypass FIDO2/passkeys?

No. CISA identifies FIDO2 and passkeys as the only widely available MFA that an AiTM proxy cannot relay. The cryptographic challenge-response protocol is cryptographically bound to the legitimate domain’s origin, meaning an attacker-controlled proxy cannot intercept or replay it. This makes phishing-resistant MFA the single highest-ROI identity security investment for organizations still relying on weaker factors.

Is device-code phishing detectable by email security gateways?

Based on current evidence, no. Huntress documented EvilTokens device-code phishing passing untouched through Cisco, Trend Micro, and Mimecast filters because the lure contains a legitimate Microsoft device-code URL. There is no malicious payload, attachment, or link for signature or reputation engines to flag. Detection must rely on monitoring anomalous device-code token issuance and unfamiliar device registrations at the identity layer.

What should an IR playbook for token theft look like?

An assume-breach playbook for token theft must go beyond a password reset: revoke all active sessions and refresh tokens for the compromised account, force re-authentication with phishing-resistant MFA, audit attacker-registered MFA devices and malicious OAuth consents, and analyze all data accessed during the token’s valid lifespan to determine the full scope of compromise.

ToolBrain — tool reviews, LLM comparisons, and AI workflow guides
NiteAgent — AI agent development, frameworks, and production patterns

Cross-links automatically generated from None.