Global Coalition Disrupts Tycoon 2FA Phishing Service
Europol and Microsoft, with industry partners and law enforcement, dismantled core Tycoon 2FA infrastructure and seized 330 domains. The subscription phishing‑as‑a‑service ran adversary‑in‑the‑middle campaigns that captured credentials, OTPs, and session cookies and was linked to tens of millions of phishing emails and roughly 96,000 victims across education, healthcare, and local government. Coinbase traced blockchain payments tied to the platform and legal actions target alleged operators.