Malware & Tooling · Credential Theft

Global coalition disrupts Tycoon 2FA phishing service

Europol and Microsoft, with industry partners and law enforcement, dismantled core Tycoon 2FA infrastructure and seized 330 domains. The subscription phishing‑as‑a‑service ran adversary‑in‑the‑middle campaigns that captured credentials, OTPs, and session cookies and was linked to tens of millions of phishing emails and roughly 96,000 victims across education, healthcare, and local government. Coinbase traced blockchain payments tied to the platform and legal actions target alleged operators.

12 sources · Mar 6

Timeline

• Mar 6 Reported by Graham Cluley
• Mar 5 Reported by Dark Reading
• Mar 4 Reported by CyberScoop

Sources

• Mar 6 Graham Cluley

  How hackers bypassed MFA with a $120 phishing kit - until a global takedown shut it down

  In a co-ordinated public-private operation between law enforcement agencies and cybersecurity industry partners one of the world's most prolific phishing-as-a-service platforms has been dismantled.

  original

• Mar 5 Dark Reading

  Tycoon 2FA Goes Boom as Europol, Vendors Bust Phishing Platform

  The phishing-as-a-service platform was popular among cyber threat actors because of its ability to bypass multi-factor authentication defenses.

  original

• Mar 5 The Record from Recorded Future

  Police dismantle major phishing platform blamed for attacks on hospitals and schools

  International law enforcement agencies have dismantled a major phishing-as-a-service platform used to target hundreds of thousands of accounts worldwide, including those tied to hospitals and schools, Europol said Wednesday.

  original

Part of the PlainSec briefing for 2026-03-06

Every edition of this story: Global coalition disrupts Tycoon 2FA phishing service