Europol, Microsoft Announce Global Disruption of Tycoon 2FA Phishing Platform
Summary
Europol, Microsoft and partners announced a joint effort disrupting Tycoon 2FA, a phishing-as-a-service platform. The operation seized 330 active domains; Microsoft attributed large-scale phishing activity and an estimated 96,000 victims to the service.
Key points
- The operation involved court orders, intelligence from cybersecurity firms and seizure of 330 active Tycoon 2FA domains, including control panels and phishing pages.
- Law enforcement agencies from Latvia, Lithuania, Portugal, Poland, Spain and the UK participated, alongside technology and cybersecurity organizations.
- Microsoft said Tycoon 2FA accounted for roughly 62% of the phishing attempts it blocked last year and was used to send tens of millions of phishing emails to 500,000 organizations monthly.
- Microsoft estimated that the service was linked to 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers.
- Tycoon 2FA enabled phishing operators to capture credentials and authentication codes and intercept authentication sessions to access targeted email and cloud accounts.
- Legal action was taken against multiple people suspected of operating the service, including Saad Fridi, whom Microsoft said was believed to be its main developer.
Article Details
- Event Type
- Joint law-enforcement and industry takedown of the Tycoon 2FA phishing-as-a-service platform
- Impact
- The operation seized 330 active Tycoon 2FA domains, including control panels and phishing pages. Microsoft reported that the platform accounted for roughly 62% of phishing attempts it blocked last year and had been used to send tens of millions of phishing emails to 500,000 organizations each month. Microsoft also estimated that the service was linked to 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers. The platform enabled credential and authentication-code capture, MFA bypass, and access to targeted email and cloud accounts.
MITRE ATT&CK
Threat Actors
Vendors
CloudflareThe list of security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the laweSentirein the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm Crowell, and cybersecurity organizationsIntel471The list of security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the lawMicrosoftEuropol, Microsoft, and cybersecurity companies on Wednesday announced a joint effort to take down the widely used phishing-as-a-service platform Tycoon 2FA.ProofpointThe list of security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the lawResecuritycompanies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm Crowell, andSpycloudthat also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm Crowell, and cybersecurityTrendAIof security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm
Products
Countries
LatviaLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.LithuaniaLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.Pakistantaken against multiple individuals suspected of running the operation, including Saad Fridi, based in Pakistan and believed to be the platform’s main developer.PolandLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.PortugalLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.SpainLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.United KingdomLaw enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said.