Tycoon 2FA Phishing Kit Disrupted by Microsoft, Europol and Partners

Microsoft, Europol and partner organizations coordinated a cross-border takedown of Tycoon 2FA, a prolific phishing-as-a-service platform that used adversary-in-the-middle (AiTM) techniques to bypass multifactor authentication and harvest credentials, session tokens, and real-time codes; the service sent tens of millions of phishing messages, impacted over 500,000 organizations (including healthcare and education), and used sophisticated evasion and domain-rotation techniques before seizures of infrastructure and domains disrupted its activity.