Authorities Shut Down Tycoon 2FA Phishing Platform Used to Bypass MFA

Europol and international partners dismantled Tycoon 2FA, a commercial reverse‑proxy phishing‑as‑a‑service that bypassed multi‑factor authentication by capturing session tokens, enabling widespread credential theft and account takeover. The service operated as a subscription offering phishing templates and dashboards, was linked to tens of millions of phishing emails monthly and attacks on over 500,000 organizations, and investigators seized roughly 330 domains and disabled hosting resources—though researchers warn similar frameworks will likely reappear.