Tycoon 2FA Infrastructure Update: Threat Actors Adapt Following Global Coalition Takedown Following a coordinated global takedown of Tycoon 2FA infrastructure, operators rapidly pivoted to new authentication sources—notably ProxyLine and several new ASNs—while continuing to use the same underlying phishing kit. TRU observed WebSocket-based real-time credential and 2FA token capture, persistent Application ID and axios user‑agent patterns, and provided IOCs, detection queries, and mitigation recommendations. #Tycoon2FA #ProxyLine

Following a global takedown of Tycoon 2FA infrastructure, operators shifted to new ASNs and ProxyLine proxies to maintain WebSocket-based credential and 2FA token capture using the same phishing kit. #Tycoon2FA #ProxyLine #GlobalTakedown

Tycoon2FA phishing platform returns after recent police disruption The Tycoon2FA phishing-as-a-service (PhaaS) platform that Europol and partners disrupted on March 4 has already returned to previously observed activity levels. [...]

#Tycoon2FA #phishing platform returns after recent police disruption

www.bleepingcomputer.com/news/security/tycoon2fa-...

#cybercrime #cybersecurity

Tycoon2FA phishing platform returns after recent police disruption The Tycoon2FA phishing-as-a-service platform disrupted by Europol and Microsoft on March 4 briefly saw activity fall after 330 domains were seized, but it returned to previous operational volumes within days. CrowdStrike reported daily campaign volumes dropped to about 25% on March 4–5 before rebounding to early 2026 levels, with the service continuing to target Microsoft 365 and Gmail accounts for BEC and cloud takeovers. #Tycoon2FA #Microsoft365

The Tycoon2FA phishing platform resurged days after Microsoft and Europol seized 330 domains. CrowdStrike notes campaign volumes briefly dropped to 25% before returning to early 2024 levels, targeting Microsoft 365 and Gmail for BEC. #Tycoon2FA #Microsoft365

Tycoon 2FA Still Active After Takedown
Read More: buff.ly/elJsmNc

#Tycoon2FA #PhishingAsAService #MFABypass #CredentialTheft #ThreatIntel #Cybercrime #AccountSecurity #InfosecAlert

Tycoon 2FA Fully Operational Despite Law Enforcement Takedown Tycoon 2FA remains operational despite an international takedown and quickly returned to pre-disruption levels. The subscription-based PhaaS has generated over 30 million malicious emails monthly, was linked to roughly 96,000 victims, and accounted for 62% of Microsoft's blocked phishing attempts in 2025. #Tycoon2FA #CrowdStrike...

Tycoon 2FA resurfaced quickly after a global takedown, sending 30M+ malicious emails monthly and linked to 96,000 victims. Europol and Microsoft seized 330 domains, but operations persist. #Tycoon2FA #Microsoft #Europol

Reactie Trend Micro op Operation Synergia III met INTERPOL

#Persbericht #TrendMicro #INTERPOL #Tycoon2FA

Reactie Trend Micro op Operation Synergia III met INTERPOL

#Persbericht #TrendMicro #INTERPOL #Tycoon2FA

Tycoon 2FA Phishing Platform Disrupted
Read More: buff.ly/jehcYZi

#Tycoon2FA #PhishingAsAService #MFABypass #Europol #MicrosoftSecurity #CybercrimeCrackdown #CredentialTheft #GlobalCyber

Europol dismantles Tycoon 2FA, a major phishing-as-a-service platform linked to 64,000 attacks, marking a significant victory against cybercrime. #CyberSecurity #Phishing #Europol #Tycoon2FA Link: thedailytechfeed.com/europol-shut...

Europol Busts Tycoon 2FA Phishing Service
Read More: buff.ly/oNb3sJB

#Tycoon2FA #PhishingAsAService #MFABypass #Europol #LawEnforcement #CredentialTheft #CybercrimeCrackdown #InfosecNews

📰 Operasi Europol Lumpuhkan Platform Phishing Tycoon2FA

👉 Baca artikel lengkap di sini: ahmandonk.com/2026/03/05/europol-tycoo...

#europol #keamananSiber #microsoft #phishing #tycoon2fa

Authorities Shut Down Tycoon 2FA Phishing Platform Used to Bypass MFA Follow us on all social media platforms @Hackread

🎣 Authorities have seized over 300 domains and dismantled the #Tycoon2FA phishing kit used by attackers to bypass MFA in targeted attacks against businesses.

Read: hackread.com/tycoon-2fa-p...

#CyberSecurity #CyberCrime #Phishing #Scam

Europol greift durch: Eine der weltweit größten Phishing-Plattformen zerschlagen - Golem.de Mit Tycoon 2FA konnten Angreifer per Abo Phishing-Kampagnen starten und etwa Microsoft- und Google-Konten kapern. Doch das ist jetzt vorbei.

#Europol greift durch:

Eine der weltweit größten #Phishing-Plattformen zerschlagen

Mit #Tycoon2FA konnten Angreifer per #Abo #Phishing-Kampagnen starten und etwa #Microsoft- und #Google-Konten kapern. Doch das ist jetzt vorbei. (Phishing, Microsoft)

www.golem.de/news/europol...

Europäische Strafverfolger zerschlagen Phishing-Plattform Tycoon2FA gehörte zu den weltweit größten Phishing-Operationen. Sie ermöglichte Kriminellen unbemerkten Zugriff auf E-Mail-Konten. Nun wurde sie abgeschaltet.

Europäische #Strafverfolger zerschlagen #PhishingPlattform #EuroPol #EU #Tycoon2FA #Phishing #CyberCrime
heise.de/-11199550

Europol-coordinated action disrupts Tycoon2FA phishing platform An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform linked to tens of millions of phishing messages each month.

#Europol-coordinated action disrupts #Tycoon2FA #phishing platform

www.bleepingcomputer.com/news/security/europol-co...

#cybercrime #cybersecurity

Tycoon 2FA PhaaS Takedown

~Trendmicro~
Europol, Microsoft, and partners seized infrastructure of the Tycoon 2FA AitM phishing platform.
-
IOCs: Tycoon 2FA
-
#Phishing #ThreatIntel #Tycoon2FA

Tycoon2FA AiTM Phishing Kit Analysis

~Microsoft~
Microsoft disrupted Tycoon2FA, a massive AiTM phishing-as-a-service kit bypassing MFA via session cookie theft.
-
IOCs: immutable. nathacha. digital, mock. zuyistoo. today, astro. thorousha. ru
-
#Phishing #ThreatIntel #Tycoon2FA

Disruption targets Tycoon 2FA, popular AiTM PhaaS | Proofpoint US Key findings  Tycoon 2FA is one of the most popular phishing-as-a-service (PhaaS) platforms currently used by threat actors, and highest volume adversary-in-the-middle (AiTM)

Proofpoint was proud to assist in the law enforcement and private sector investigations into #Tycoon2FA activity and supported Microsoft’s action with data, including malicious domains and info related to Tycoon 2FA campaigns.

See our blog for details. brnw.ch/21x0s76

Tycoon 2FA splash page.

The popular phishing-as-a-service (PhaaS) platform used by threat actors, #Tycoon2FA, has been disrupted by law enforcement and private sector partners, including @microsoft.com, Europol, Proofpoint, @cloudflare.social, and TrendAI.

Details in our blog: brnw.ch/21x0s76

Phishing Actors Exploit Routing Misconfigs to Spoof Domains

~Microsoft~
Actors exploit misconfigured email routing to send spoofed internal phish, often using the Tycoon2FA PhaaS platform.
-
IOCs: 162. 19. 196. 13, 163. 5. 221. 110, 51. 195. 94. 194
-
#Phishing #Spoofing #ThreatIntel #Tycoon2FA

Beware of Tycoon 2FA: A sophisticated phishing kit targeting Microsoft 365 and Gmail users, capable of bypassing MFA protections. Stay vigilant! #CyberSecurity #Phishing #MFA #Tycoon2FA Link: thedailytechfeed.com/new-phishing...

Phishing Campaign Targets UK Telecom Companies

~Anyrun~
Attackers are using the Tycoon2FA phishing kit in a mass campaign targeting UK telecom companies to steal Microsoft credentials.
-
IOCs: xjrsel. ywnhwmard[. ]es, ksi[. ]com[. ]pk
-
#Phishing #ThreatIntel #Tycoon2FA

August 2025 Cyber Attacks: Tycoon2FA, ClickFix & Salty2FA

~Anyrun~
New campaigns feature a 7-stage Tycoon2FA phishing kit, Rhadamanthys stealer, and the Storm-1575 linked Salty2FA PhaaS.
-
IOCs: filecloudonline. com, 84. 200. 80. 8, marketplace24ei. ru
-
#Phishing #Salty2FA #ThreatIntel #Tycoon2FA

🎣 Leveraging our telemetry and proactive hunting, we ranked the most widespread AitM phishing kits - #Tycoon2FA, #Storm1167, #NakedPages, #Sneaky2FA, and more.

Additionally, the article includes summary sheets covering 11 AitM phishing kits.

Tycoon2FA Phishing Attack Exposes Microsoft 365: Protected 2025 Discover how the Tycoon2FA phishing campaign is targeting Microsoft 365 users with backslash URL tricks to steal credentials. Learn how...

🚨 Tycoon2FA Phishing Alert
A new phishing attack targets Microsoft 365 users using malformed URLs to bypass MFA and steal

🔗 Full blog: technijian.com/desktop-supp...
🎧 Podcast: technijian.com/podcast/tyco...

#Tycoon2FA #PhishingAttack #Microsoft365 #CyberSecurity #Technijian #MFABypass

Evolution of Tycoon 2FA Phishing Evasion

~Anyrun~
Analysis details Tycoon 2FA phishing kit's evolving evasion techniques: obfuscation, anti-analysis, dynamic content.
-
IOCs: stellarnetwork. sucileton. com
-
#Evasion #Phishing #ThreatIntel #Tycoon2FA

This worrying Microsoft 365 phishing kit has seen a huge upgrade, experts warn Tycoon2FA is now more dangerous than ever

#Tycoon2FA, an infamous #phishing-as-a-service (PhaaS) platform, has been greatly improved, becoming even more difficult to spot and eliminate buff.ly/KNxZUWH
via @techradar.com.web.brid.gy #cybersecurity

Tycoon2FA phishing kit targets Microsoft 365 with new tricks Phishing-as-a-service (PhaaS) platform Tycoon2FA, known for bypassing multi-factor authentication on Microsoft 365 and Gmail accounts, has received updates that improve its stealth and evasion capabil...

New Tycoon 2FA phishing kit bypasses Microsoft 365 multi-factor authentication with advanced real-time tactics. #Phishing #Microsoft365 #CyberSecurity #2FA #Infosec #Tycoon2FA www.bleepingcomputer.com/news/securit...

Tycoon2FA phishing kit rolled out significant updates The operators of the Phishing-as-a-Service platform Tycoon2FA have rolled out significant updates to enhance its evasion capabilities.

Tycoon2FAフィッシングキットが大幅にアップデート

Tycoon2FA phishing kit rolled out significant updates #SecurityAffairs (Apr 14)

#Tycoon2FA #フィッシングキット #PhaaS #検出回避 #サイバーセキュリティ