Authorities Dismantle Tycoon 2FA Phishing Service, Seizing 330 Domains
Summary
Authorities dismantled Tycoon 2FA and seized 330 domains. The service intercepted login sessions and one-time codes to bypass MFA; Microsoft reported widespread targeting and operational disruptions at affected organizations.
Key points
- International law enforcement dismantled the Tycoon 2FA phishing-as-a-service platform and seized 330 domains used for its infrastructure and phishing sites.
- The service intercepted authentication sessions, credentials and one-time codes in real time to bypass multi-factor authentication.
- Active since 2023, Tycoon 2FA sent tens of millions of phishing emails monthly and targeted more than 500,000 organizations, according to the article.
- Microsoft said more than 100 Health-ISAC members were successfully phished; organizations in New York also reported attempted or successful compromises.
- Microsoft reported that compromised accounts caused operational disruptions and patient-care delays.
- Microsoft said Tycoon 2FA accounted for about 62% of phishing attempts it blocked at the service’s peak.
- Authorities believe the developer was based in Pakistan and worked with partners handling marketing, payments and customer support.
Article Details
- Event Type
- International law enforcement dismantled the Tycoon 2FA phishing-as-a-service platform and seized 330 domains used to host phishing sites and operate its infrastructure.
- Impact
- The platform reportedly sent tens of millions of phishing emails each month and targeted more than 500,000 organizations. Microsoft reported that over 100 Health-ISAC members were successfully phished; in New York, at least two hospitals, six public schools, and three universities reported attempted or successful compromises. Compromised accounts caused operational disruptions and delays in patient care. Authorities believe the developer operated from Pakistan.
MITRE ATT&CK
T1078 · Valid AccountsThe article reports that attackers used captured credentials and authentication codes to log in as legitimate users.T1111 · Multi-Factor Authentication InterceptionThe platform intercepted authentication sessions and one-time verification codes to bypass multi-factor authentication.T1566 · PhishingTycoon 2FA sent phishing emails and used phishing sites to target organizations.
Products
Countries
Industries
EducationHealthcare and education sectors were heavily impacted, including over 100 Health-ISAC members and multiple hospitals and schools in New York.HealthcareHealthcare and education sectors were heavily impacted, including over 100 Health-ISAC members and multiple hospitals and schools in New York.