Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks

Estimated Reading Time: 7 minutes

Key Takeaways:

  • International law enforcement dismantled Tycoon 2FA, a major Phishing-as-a-Service platform responsible for 64,000+ attacks.
  • The platform utilized Adversary-in-the-Middle (AitM) techniques to bypass traditional Multi-Factor Authentication (MFA).
  • Zero-day vulnerability exploitation saw a 15% increase in 2025, with enterprise edge devices becoming primary targets.
  • Transitioning to phishing-resistant authentication like FIDO2/WebAuthn is critical for modern enterprise security.

Table of Contents:

A coalition of international law enforcement agencies and private sector security partners recently completed a major operation to dismantle Tycoon 2FA. This Phishing-as-a-Service (PhaaS) platform was a primary driver for adversary-in-the-middle (AitM) credential harvesting. According to Europol, the platform facilitated over 64,000 attacks, targeting approximately 100,000 organizations globally. The takedown involved the seizure of 330 domains that formed the core of the service’s infrastructure, including phishing pages and administrative control panels.

The Tycoon 2FA operation highlights the industrialization of cybercrime. By providing low-cost access to sophisticated tools, the platform lowered the barrier to entry for thousands of threat actors. For organizations, this underscores the necessity of a cyber threat intelligence platform capable of identifying emerging toolkits before they are deployed at scale.

Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks: The Technical Infrastructure

Tycoon 2FA emerged in August 2023 and quickly became one of the most prolific PhaaS providers. The service operated on a subscription model, offering access for as little as $120 for 10 days or $350 for a full month. The developer, allegedly Pakistan-based Saad Fridi, managed the operation through a web-based administration panel that allowed users to configure, track, and refine their phishing campaigns.

The panel provided attackers with:

  • Pre-built templates mimicking brands like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail.
  • Redirect logic to bypass automated security filters.
  • Victim tracking and sign-in attempt logs.
  • Attachment generation for common lure formats.

A significant component of the service was its integration with telegram threat monitoring channels. Operators used Telegram and Signal to sell the kit and provide updates to their user base. The platform’s ability to generate tens of millions of phishing emails monthly made it a significant threat to enterprise environments. Data from Microsoft suggests that Tycoon 2FA accounted for 62% of all blocked phishing attempts as of mid-2025. In October 2025 alone, Microsoft blocked more than 13 million malicious emails linked to the service, which they track as Storm-1747.

Mechanics of Adversary-in-the-Middle (AitM) Attacks

The primary danger of Tycoon 2FA was its capability to facilitate AitM attacks. Unlike traditional phishing, which merely steals static passwords, AitM attacks intercept the entire authentication process. When a victim enters their credentials on a Tycoon-hosted page, the kit proxies those credentials to the legitimate service in real-time.

When the legitimate service issues a multi-factor authentication (MFA) challenge, the phishing kit presents that challenge to the victim. Once the victim provides the MFA code or approves the push notification, the kit captures the resulting session token. This allows the attacker to bypass MFA and gain full access to the account without needing the user’s password again until the session expires.

Tycoon 2FA employed several techniques to evade detection:

  • Anti-bot screening: To prevent security crawlers from identifying phishing pages.
  • Code obfuscation: Use of custom JavaScript and heavy obfuscation to hinder static analysis.
  • Short-lived FQDNs: Use of Cloudflare-hosted fully qualified domain names that lasted only 24 to 72 hours.
  • Browser fingerprinting: Identifying and blocking requests that did not originate from a legitimate user’s browser environment.

This level of sophistication is typically associated with advanced persistent threats (APTs), but PhaaS models make these capabilities available to nearly 2,000 users.

For many organizations, breach detection often occurs too late, after the session token has already been used to exfiltrate data or move laterally through the network.

Geographic and Sector-Specific Impact

Victim log data indicates a heavy concentration of targets in Western economies. The United States recorded the highest volume with 179,264 identified victims. Other heavily targeted nations included:

  • United Kingdom: 16,901
  • Canada: 15,272
  • India: 7,832
  • France: 6,823

Analysis suggests that Tycoon 2FA was primarily directed at business environments. The majority of targeted accounts were enterprise-managed or associated with paid domains. The sectors impacted were diverse, ranging from healthcare and education to finance and government institutions. This relationship between credential theft and subsequent attacks highlights the need for real-time ransomware intelligence to understand the full attack chain.

The rise of services like Tycoon 2FA occurs alongside an increase in the exploitation of zero-day vulnerabilities. The Google Threat Intelligence Group (GTIG) reported that 90 zero-day vulnerabilities were exploited in 2025, a 15% increase from 2024. Nearly half of these vulnerabilities targeted enterprise products, specifically security appliances and VPNs.

Key findings from the GTIG report include:

  • Targeting Enterprise Edge: Attackers are moving toward edge devices that lack Endpoint Detection and Response (EDR) monitoring.
  • Memory Safety: 35% of exploited zero-days were related to memory safety issues.
  • Commercial Spyware: These vendors surpassed state-sponsored groups as primary users of zero-day exploits.
  • Financial Motivation: Ransomware groups accounted for nine of the exploited zero-days.

Microsoft was the most targeted vendor with 25 zero-days, followed by Google and Apple. This data emphasizes the importance of supply-chain risk monitoring as organizations rely on these vendors for core infrastructure.

Critical Vulnerabilities in Cisco Secure Firewall Management Center

Cisco recently disclosed two max-severity vulnerabilities in its Secure Firewall Management Center (FMC) Software. These flaws, CVE-2026-20079 and CVE-2026-20131, allow unauthenticated, remote attackers to obtain root access or execute arbitrary code. These vulnerabilities are particularly dangerous because the FMC serves as the “administrative nerve center” for network security.

There are currently no workarounds for these defects. Organizations are urged to apply patches immediately, as Cisco edge technology has been a frequent target for long-term exploitation campaigns, some of which remained undetected for over three years.

Financial Cybercrime and Data Breaches

The enforcement landscape also saw the arrest of John Daghita, linked to the theft of $46 million in cryptocurrency from the U.S. Marshals Service. Meanwhile, the healthcare and insurance sectors continue to face repercussions from delayed breach detection. Trizetto is currently notifying 3.4 million individuals regarding a hack that was not detected for nearly a year. Monitoring these environments requires a dedicated dark web monitoring service to identify leaked credentials before they are utilized in secondary attacks.

Takeaways for Technical and Non-Technical Stakeholders

Technical Takeaways

  • Implement FIDO2/WebAuthn: Hardware-based security keys provide protection that phishing kits cannot easily proxy.
  • Monitor Session Token Anomalies: Flag impossible travel or unrecognized device fingerprints.
  • Harden Edge Infrastructure: Prioritize patching for VPNs and Firewalls within a rigorous management program.
  • Utilize Threat Intelligence APIs: Integrate live ransomware intelligence into your SIEM/SOAR to automate blocking of malicious infrastructure.

Business Leadership Takeaways

  • Acknowledge MFA Limitations: Support the transition to phishing-resistant authentication methods.
  • Evaluate Third-Party Risk: Supply-chain risk monitoring should be a standard part of vendor management.
  • Focus on Detection Time: Reduce attacker “dwell time” through better internal monitoring and brand leak alerting.
  • Invest in Specialized Intelligence: Access to niche underground data provides early warning signs of targeted campaigns.

PurpleOps Expertise in Threat Mitigation

PurpleOps provides the technical depth and intelligence necessary to counter these sophisticated threats. Our cyber threat intelligence platform aggregates data from across the surface and dark web, providing real-time intelligence and alerting to identify threats before they impact your operations.

For organizations concerned about the integrity of their network edge, PurpleOps offers specialized services:

  • to identify vulnerabilities before they are exploited.
  • Red Team Operations to simulate advanced AitM attacks and test your response controls.
  • Dark Web Monitoring to scan for leaked credentials and underground forum intelligence.
  • Supply Chain Security to manage risks associated with third-party software and vendors.

By integrating cyber threat intelligence into your security strategy, you can move beyond reactive patching. Our platform and PurpleOps Solutions are designed to protect against the full spectrum of modern cyber threats, including advanced phishing.

Frequently Asked Questions

1. What is Tycoon 2FA?
Tycoon 2FA was a Phishing-as-a-Service (PhaaS) platform that allowed cybercriminals to launch sophisticated Adversary-in-the-Middle attacks to bypass multi-factor authentication for enterprise accounts.

2. How does an Adversary-in-the-Middle (AitM) attack bypass MFA?
An AitM attack works by proxying the authentication session in real-time. The attacker captures both the user’s password and the session token generated after the MFA code is entered, allowing them to hijack the active session.

3. What makes FIDO2/WebAuthn more secure than traditional MFA?
FIDO2 and WebAuthn use hardware-backed cryptographic keys that are tied to the specific domain of the service. Because the key will only sign a challenge from the legitimate domain, it cannot be proxied by a phishing site.

4. Why are edge devices like firewalls being targeted more frequently?
Edge devices often lack the deep monitoring and EDR tools found on workstations. Compromising a firewall or VPN gives attackers a direct foothold into the network while remaining invisible to traditional endpoint security.