people · May 20, 2026
Steven Lim Shares CloudApp Hunting Query for Tycoon 2FA Activities Based on eSentire TRU Research
Share the canonical public link.
Steven Lim posted a CloudApp hunting query on May 17, 2026 for identifying Tycoon 2FA related activities following eSentire Threat Research Unit research. The query filters for UserAgents matching node, undici or axios with ISP alibaba in the last 30 days. eSentire TRU research covers Tycoon 2FA operators adopting OAuth device-code phishing for Microsoft 365 access. Steven Lim's post received 90 likes and 17 reposts with 5894 views.
Below validation threshold — auto-passed without scoring