US EditionMicrosoft, Europol Take Down Global Phishing as a Service Network Which Was Able to Bypass 2FA with Ease
- On March 4, 2026, Europol coordinated an international operation disrupting Tycoon2FA and taking 330 domains offline, with Microsoft leading technical efforts across Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom.
- Tycoon2FA first emerged in August 2023 as an adversary-in-the-middle reverse proxy intercepting credentials, one-time passcodes, and session cookies to bypass MFA and compromise nearly 100,000 organizations.
- Researchers linked the operation to monikers SaaadFridi and MrXaad, noting it had more than 24,000 domains and roughly 2,000 users at disruption, sold via Telegram for $120 for 10 days.
- The takedown is a setback but does not eliminate the threat as previously stolen credentials and active session cookies may persist; TrendAI will continue monitoring and support investigations.
- Security experts say the takedown highlights that MFA alone is insufficient and recommend phishing-resistant authentication, strict conditional access, advanced email security, real-time URL inspection, and continuous identity-risk monitoring as identity is the primary attack surface.
38 Articles
38 Articles
An international operation coordinated by Europol has resulted in the dismantling of Tycoon 2FA, an online service used by cyber criminals to hack large-scale accounts. ...
Global coalition dismantles Tycoon 2FA phishing kit
Tycoon 2FA, a major phishing kit and platform that allowed low-skilled cybercriminals to bypass multifactor authentication and conduct large-scale adversary-in-the-middle attacks, was dismantled Wednesday by a global coalition of security companies and law enforcement agencies. Microsoft, which led the effort alongside Europol and authorities from six countries and 11 security firms or organizations, said it seized 330 domains that powered Tycoo…
PJ explained that the Tycoon 2FA platform was in operation since August 2023 and allowed "to pass multifactor authentication mechanisms and ensure illegal access to e-mail boxes".
Coverage Details
Bias Distribution
- 89% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
