Tycoon 2FA Infrastructure Update: Threat Actors Adapt Following Global Coalition Takedown Following a coordinated global takedown of Tycoon 2FA infrastructure, operators rapidly pivoted to new authentication sources—notably ProxyLine and several new ASNs—while continuing to use the same underlying phishing kit. TRU observed WebSocket-based real-time credential and 2FA token capture, persistent Application ID and axios user‑agent patterns, and provided IOCs, detection queries, and mitigation recommendations. #Tycoon2FA #ProxyLine

Following a global takedown of Tycoon 2FA infrastructure, operators shifted to new ASNs and ProxyLine proxies to maintain WebSocket-based credential and 2FA token capture using the same phishing kit. #Tycoon2FA #ProxyLine #GlobalTakedown