Global Takedown Neutralizes Tycoon2FA Phishing Service

Microsoft, Europol and industry partners seized infrastructure linked to Tycoon2FA, a subscription-based phishing-as-a-service that used adversary-in-the-middle techniques to intercept live authentication sessions and bypass multi-factor authentication, enabling large-scale enterprise account takeovers; investigators seized over 300 domains tied to the service, which had roughly 2,000 users and used more than 24,000 domains since August 2023, and identified likely operator aliases while urging organizations to adopt phishing-resistant auth, advanced email protections, real-time URL inspection, continuous identity risk monitoring, and training.