Global takedown hits Tycoon 2FA, phishing kit that beat multi-factor logins
Microsoft, Europol and police in six European countries dismantled Tycoon 2FA, a phishing-as-a-service platform that let low-skilled criminals bypass multi-factor authentication on Microsoft 365 and Google accounts, the companies and agencies announced March 4.
The kit matters to small businesses because it defeated the protection many of them were told was enough: a code sent by text or an authenticator app. Microsoft Threat Intelligence linked Tycoon 2FA to tens of millions of phishing messages a month reaching more than 500,000 organizations worldwide, CyberScoop reported.
How it worked
Tycoon 2FA used a reverse proxy that sat between the victim and the real login page. When a user typed a password and a one-time code, the kit passed them through to Microsoft or Google and captured the session cookie, giving the attacker a logged-in session. The platform, which emerged in August 2023, was sold on Telegram and Signal and came with templates, lure attachments and hosting setup.
By mid-2025, Tycoon 2FA accounted for about 62 per cent of the phishing attempts Microsoft blocked, peaking at more than 30 million e-mails in a single month, CSO Online reported. Microsoft linked it to about 96,000 victims since 2023, including more than 55,000 Microsoft customers. Education and health care were hit hardest.
The takedown
Microsoft obtained a U.S. court order to seize 330 domains used for control panels and fake login pages, and filed a civil complaint with Health-ISAC in New York against an alleged creator and four unnamed associates. Authorities in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom seized infrastructure, with help from companies including Cloudflare, Coinbase, Proofpoint, Trend Micro and Canadian security firm eSentire.
Experts warned the operators may rebuild or that copycat kits will fill the gap. In July, Microsoft reported that Tycoon-linked phishing had fallen 92 per cent from pre-disruption levels, while other techniques grew.
What to do
- Move administrators and finance staff to phishing-resistant sign-in such as passkeys or FIDO2 security keys, which a proxy cannot relay.
- Set up SPF, DKIM and DMARC for your domain to make spoofing harder.
- In Microsoft 365, review risky sign-ins and new inbox rules, and revoke sessions, not just passwords, after a suspected compromise.
