A massive international operation coordinated by Europol successfully disrupted Tycoon 2FA, one of the world’s most prolific “phishing-as-a-service” (PhaaS) platforms. The service was notorious for providing cybercriminals with ready-made tools to bypass multi-factor authentication (MFA) via “adversary-in-the-middle” (AitM) attacks.

Key Impacts of the Takedown

• Infrastructure Seizure: Authorities seized 330 domains that formed the platform’s backbone, including its command-and-control panels and active phishing pages.
• Scale of Victimization: Prior to its disruption, the platform facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions.
• Global Reach: Tycoon 2FA was responsible for generating tens of millions of phishing emails every month. By mid-2025, it accounted for approximately 62% of all phishing attempts blocked by Microsoft.

Operation Details

The action was a landmark example of public-private collaboration, involving law enforcement from Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom.

• Private Partners: Technical disruption was led by Microsoft with critical intelligence and support from Trend Micro, Intel 471, Proofpoint, Cloudflare, and Coinbase.
• Legal Action: Microsoft and Health-ISAC filed a lawsuit against the alleged creator, Saad Fridi, and other unnamed associates in the U.S. District Court for the Southern District of New York.
• Tracking Methods: Investigators from Coinbase traced cryptocurrency payments used to fund the service, while Microsoft analysts posed as customers to map the infrastructure.

Why Tycoon 2FA Was Dangerous

The platform lowered the barrier to entry for cybercrime by offering a low-cost subscription model (starting at $120–$200) that automated complex attacks. It used AitM proxying to intercept live authentication sessions, capturing credentials and session cookies in real-time, which allowed attackers to bypass traditional MFA protections.