Global coalition dismantles Tycoon 2FA phishing kit

Tycoon 2FA, a widely used phishing-as-a-service platform enabling adversary-in-the-middle MFA bypass, was dismantled in a coordinated operation led by Microsoft, Europol and multiple international partners. The platform—attributed to a group tracked as Storm-1747—facilitated tens of millions of phishing messages (peaking at >30M/month), impacted an estimated 96,000 victims worldwide (including healthcare and education organizations), and had infrastructure and domains seized while civil complaints were filed against its operators.