Tycoon 2FA Dismantled: Europol Ends a Global Phishing Empire

Europol, working with law enforcement and private sector partners, has dismantled Tycoon 2FA, one of the most prolific phishing‑as‑a‑service (PhaaS) platforms. The kit enabled adversary‑in‑the‑middle (AiTM) attacks at scale, harvesting credentials, MFA codes, and session cookies from victims worldwide.

What Was Tycoon 2FA?

Launch: Emerged in August 2023.
Business model: Subscription‑based — $120 for 10 days, $350 for a month with full admin panel access.
Capabilities:
- Pre‑built phishing templates for Microsoft 365, Gmail, SharePoint, and more.
- Session cookie theft to bypass MFA.
- Victim tracking and campaign analytics.
- Real‑time credential forwarding via Telegram.
Scale: Tens of millions of phishing emails monthly, impacting nearly 100,000 organizations globally.

Impact

Incidents: Linked to over 64,000 phishing attacks.
Infrastructure: 330 domains taken down, including phishing pages and control panels.
Reach: Targeted schools, hospitals, governments, and enterprises across sectors.
Prolific: Microsoft blocked 13+ million emails tied to Tycoon 2FA in 2025 alone.
Users: ~2,000 cybercriminals subscribed to the service.

Techniques Used

AiTM phishing: Intercepted credentials and MFA codes via proxy servers.
ATO Jumping: Used compromised accounts to spread phishing URLs, increasing trust.
Stealth tactics:
- Browser fingerprinting.
- Keystroke monitoring.
- Obfuscated code and decoy pages.
- Short‑lived domains (24–72 hours) hosted on Cloudflare to evade blocklists.

Defensive Lessons

Identity focus: MFA alone isn’t enough — session hijacking bypasses it.
Cross‑domain detection: Correlate signals across email, identity, and endpoints.
Revocation discipline: Resetting passwords isn’t sufficient; revoke active sessions and tokens.
Threat intelligence: Monitor for short‑lived domains and AiTM frameworks like EvilProxy.
User awareness: Train staff to recognize phishing lures even when they mimic trusted brands.

Final Thought

Tycoon 2FA shows how phishing has evolved into a subscription economy, lowering the barrier for attackers while scaling impact globally. For leaders, the lesson is clear: identity is the new perimeter, and defenses must extend beyond MFA to session management, cross‑domain visibility, and rapid takedown collaboration.