Tycoon 2FA Goes Boom as Europol, Vendors Bust Phishing Platform

Europol and multiple private-sector partners disrupted Tycoon 2FA, a large phishing-as-a-service platform that used an adversary-in-the-middle MFA bypass to capture live session tokens and defeat MFA protections. The platform, active since 2023, accounted for a large proportion of blocked phishing attempts (about 62% of Microsoft-blocked phishing by mid-2025) and is linked to roughly 96,000 victims; partners seized infrastructure and domains while warning operators may rebuild and recommending adoption of phishing-resistant MFA such as FIDO2/passkeys.