Coalition Dismantles Tycoon 2FA Phishing Platform

A multinational coalition led by Europol, Microsoft, and Coinbase disrupted the Tycoon 2FA phishing-as-a-service platform on Wednesday, dismantling infrastructure used by cybercriminals to bypass multifactor authentication and access online accounts worldwide.

The operation targeted Tycoon 2FA, which had operated since August 2023 and emerged as one of the largest such platforms globally. Investigators described it as a subscription-based service that provided toolkits for creating spoofed login pages mimicking legitimate websites, such as those for Microsoft 365 and other services. These pages captured usernames, passwords, and authentication codes in real time. More significantly, the platform enabled attackers to steal session cookies and tokens, which served as proof of prior authentication stored in users' browsers. Armed with these, criminals could access accounts without triggering additional security prompts, turning basic phishing into a pathway for account takeovers, business email compromise, invoice fraud, and data theft.

At its peak by mid-2025, Tycoon 2FA accounted for 62 percent of phishing attempts blocked by Microsoft, including over 30 million emails in a...