Tycoon2FA Phishing Activity Rebounds Within Days of Domain Seizures

Summary

CrowdStrike observed Tycoon2FA activity drop to about 25% of pre-disruption levels after 330 domains were seized, then return to early 2026 levels within days. The platform continues targeting Microsoft 365 and Gmail accounts.

Key points

A Microsoft-led operation seized 330 domains tied to Tycoon2FA control panels and phishing pages on March 4.
CrowdStrike observed daily campaign volumes fall to about 25% of pre-disruption levels on March 4–5, then rebound to early 2026 levels within days.
Tycoon2FA uses adversary-in-the-middle techniques to bypass two-factor authentication and targets Microsoft 365 and Gmail accounts.
CrowdStrike says campaigns support business email compromise, email thread hijacking, cloud account takeovers, and malicious SharePoint links.
Post-disruption campaigns used malicious URLs, shorteners, abused redirect services, and compromised domains; new phishing domains and IP addresses appeared quickly.
CrowdStrike observed post-compromise activity including inbox-rule creation and hidden folders for fraud emails.

Article Details

Event Type: A law-enforcement and industry-led disruption of the Tycoon2FA phishing-as-a-service platform, followed by a rapid return to previous activity levels.
Impact: The disruption temporarily reduced campaign volumes to about 25% of pre-disruption levels on March 4–5, 2026, but activity returned to early-2026 levels within days. Tycoon2FA continued targeting Microsoft 365 and Gmail accounts for business email compromise, email thread hijacking, and cloud account takeovers.

MITRE ATT&CK

T1557 · Adversary-in-the-MiddleThe article says Tycoon2FA uses adversary-in-the-middle mechanisms to bypass two-factor authentication.T1566.002 · Spearphishing LinkThe article describes malicious email campaigns using malicious URLs to direct targets to phishing pages.

Vendors

MicrosoftThe Tycoon2FA phishing-as-a-service platform disrupted by Europol and Microsoft on March 4 briefly saw activity fall after 330 domains were seized, but it returned to previous operational volumes within days.

Products

GmailCrowdStrike reported daily campaign volumes dropped to about 25% on March 4–5 before rebounding to early 2026 levels, with the service continuing to target Microsoft 365 and Gmail accounts for BEC and cloud takeovers.Microsoft 365 Apps for EnterpriseCrowdStrike reported daily campaign volumes dropped to about 25% on March 4–5 before rebounding to early 2026 levels, with the service continuing to target Microsoft 365 and Gmail accounts for BEC and cloud takeovers.