Tycoon 2FA Returns to Pre-Takedown Activity Levels, CrowdStrike Says

Summary

CrowdStrike says Tycoon 2FA activity returned to pre-disruption levels soon after authorities announced a seizure of 330 active domains. The service continues phishing and session-cookie theft to bypass MFA; Salty 2FA domains may also have been affected.

Key points

CrowdStrike says Tycoon 2FA activity dropped to roughly 25% on March 4 and 5 after the law-enforcement operation, then returned to previous levels shortly afterward.
Europol and Microsoft announced the seizure of 330 active Tycoon 2FA domains and legal action against multiple individuals, in an operation involving agencies in six countries and about a dozen private companies.
The service’s reported techniques include phishing pages with malicious CAPTCHA prompts, session-cookie theft, credential proxying, and use of stolen credentials to access victims’ cloud environments.
CrowdStrike observed failed attacks after phishing pages were suspended and identified eight IP addresses likely acquired after the operation, along with phishing domains used since 2025 that were not targeted.
CrowdStrike says Tycoon 2FA was used in March for business email compromise, email-thread hijacking, phishing URL distribution through SharePoint and cloud accounts, and cloud account takeovers.
Domains associated with the Salty 2FA phishing kit appear to have been affected by the disruption, according to CrowdStrike.

Article Details

Event Type: Phishing-as-a-service operation continued and returned to pre-disruption activity levels after an international law enforcement takedown.
Impact: CrowdStrike reports that Tycoon 2FA activity briefly fell to roughly 25% on March 4 and 5, then returned to previous levels shortly afterward. The service has been linked to roughly 96,000 phishing victims worldwide; Microsoft reported that it was responsible for 62% of phishing attempts blocked by Microsoft in 2025. CrowdStrike also reports use in business email compromise, email thread hijacking, cloud account compromise, and phishing URL distribution.

MITRE ATT&CK

T1078 · Valid AccountsStolen credentials were used to access victims’ cloud environments.T1539 · Steal Web Session CookieThe operation stole session cookies after CAPTCHA validation.T1566.002 · Spearphishing LinkPhishing emails directed recipients to malicious CAPTCHA pages.

Vendors

MicrosoftResponsible for 62% of the phishing attempts blocked by Microsoft in 2025, Tycoon 2FA has been used to generate over 30 million malicious emails monthly, targeting half a million organizations.

Products

Microsoft SharePointsays, Tycoon 2FA has been used for business email compromise (BEC) phishing, email thread hijacking, SharePoint and cloud compromise for phishing URL distribution, and in cloud account takeover attacks.Tycoon2FAThe phishing-as-a-service (PhaaS) platform Tycoon 2FA’s operation has continued despite an international effort to disrupt it, CrowdStrike reports.