Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks

Tycoon 2FA was a subscription-based AiTM phishing platform sold to thousands of criminal users that intercepted credentials, MFA codes, and session cookies to enable large-scale account takeover across enterprise and consumer targets; it generated tens of millions of phishing emails monthly, impacted nearly 100,000 organizations worldwide, employed advanced evasion techniques (keystroke logging, browser fingerprinting, short‑lived domains), and was disrupted in a coordinated public‑private takedown that removed hundreds of domains and infrastructure.