Phishing Series 2026: AiTM Session-Token Theft & Replay — Tycoon2FA/Mamba2FA/EvilProxy Kit Correlation

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•1

This rule identifies potential Adversary-in-the-Middle (AiTM) activity by detecting multiple successful MFA-authenticated logins for the same user within a short timeframe, originating from different IP addresses/ASNs and featuring inconsistent user agents or non-managed device traits. This pattern is characteristic of session hijacking via phishing kits such as EvilProxy, Mamba2FA, or Tycoon2FA, where the attacker replays the stolen session token after the user has completed the MFA flow.