Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations

A multinational coalition led by Microsoft and Europol, supported by TrendAI™ and other private partners, disrupted Tycoon 2FA — a large-scale phishing-as-a-service platform that used AitM proxies to capture credentials, MFA codes, and session cookies enabling account takeovers. TrendAI™ attributed the service to an operator using the monikers “SaaadFridi”/“Mr_Xaad”, reported the platform had roughly 2,000 criminal customers and used over 24,000 domains, and warned that harvested credentials and cookies fuel a broader cybercrime ecosystem with follow-on impacts like BEC, data theft, and ransomware.