Europol-coordinated action disrupts Tycoon2FA phishing platform

The Tycoon2FA phishing-as-a-service platform, active since at least August 2023, was disrupted in a coordinated international operation led by Microsoft and Europol with multiple private partners; 330 domains belonging to the service were seized. Tycoon2FA used an adversary-in-the-middle reverse proxy to capture credentials, session cookies, and MFA codes—enabling attackers to hijack authenticated sessions and bypass MFA—while generating tens of millions of phishing emails monthly and affecting organizations worldwide, including government, education, and healthcare.