Tycoon2FA phishing-as-a-service back to full volume days after Europol takedown
Europol and Microsoft seized 330 Tycoon2FA domains on 4 March 2026; CrowdStrike says volume fell to 25% then recovered within days. How to defend against AiTM.
On 4 March 2026, Europol and Microsoft took down 330 domains behind Tycoon2FA, the phishing-as-a-service kit behind a large share of Microsoft 365 and Gmail account takeovers. CrowdStrike reports that campaign volume returned to pre-takedown levels within days. If your login flow depends on passwords plus SMS or TOTP codes, Tycoon2FA can still get past it.
What happened
Europol coordinated the disruption with law enforcement from Latvia, Lithuania, Portugal, Poland, Spain and the UK. Microsoft led the technical side under a court order from the Southern District of New York, seizing 330 domains, including control panels and phishing pages. Microsoft and Health-ISAC filed a civil complaint naming alleged developer Saad Fridi and four unnamed associates. Microsoft tracks the developer as Storm-1747. Security partners included Cloudflare, Proofpoint, Trend Micro, Intel 471, SpyCloud and others.
By Microsoft's account, the kit had been active since August 2023 and sold on Telegram and Signal for about $350 a month. By mid-2025 it accounted for roughly 62% of the phishing attempts Microsoft blocked, peaking at more than 30 million emails in a single month. Microsoft estimates about 96,000 victims, including more than 55,000 Microsoft customers, and says education and healthcare were hit hardest.
On 20 March, CrowdStrike reported that daily campaign volume had dropped to about 25% of normal on 4–5 March and then recovered to previous levels within days. Its Falcon Complete team handled at least 30 suspected Tycoon2FA incidents between 4 and 6 March alone. Some older infrastructure was never taken down, and operators quickly registered new domains and new IPv6 login infrastructure, much of it hosted by M247 Europe.
Who is affected
- Microsoft 365 / Entra ID and Google Workspace users whose second factor can be phished: SMS, voice, TOTP codes or push approvals.
- Finance, healthcare and education organisations, which are favourite targets because a compromised mailbox leads straight to BEC fraud.
- SaaS builders whose own apps use password plus OTP login. The same adversary-in-the-middle (AiTM) technique works against any web login that issues a session cookie.
What it means for developers and engineering teams
Tycoon2FA is a reverse proxy. The victim lands on a lookalike page, often behind a CAPTCHA and geofencing that serve AI-generated decoy pages to scanners. The kit then relays everything in real time to the real Microsoft or Google sign-in page. The user enters a password and an MFA code, the real identity provider issues a session cookie, and the proxy captures that cookie. The attacker replays it and is logged in without needing the password or the code again. CrowdStrike then saw the familiar post-compromise steps: inbox rules and hidden folders that hide fraud emails, followed by BEC and thread hijacking.
The takedown also shows why seizing domains alone doesn't last. When there are no arrests and the code base and customers are untouched, the operators just stand up new domains. Defenders need controls that make the stolen cookie useless, not just faster domain blocking.
- Phishing-resistant authentication (FIDO2/WebAuthn passkeys, security keys) ties the credential to the real origin, so the proxy's domain can't complete the challenge.
- Token binding and device checks (Conditional Access requiring a compliant device, token protection) stop a replayed cookie from working on the attacker's machine.
- Short sessions and continuous evaluation shrink the window in which a stolen cookie is useful.
What to do now
- Roll out passkeys or FIDO2 keys, starting with admins and finance staff, and enforce them with Conditional Access authentication strengths.
- Require compliant or hybrid-joined devices for Microsoft 365 access, and turn on token protection where your licensing supports it.
- Alert on new inbox rules that move, delete or mark mail as read, especially rules matching words like "invoice" or "payment". In Exchange Online:
Get-InboxRule -Mailbox [email protected]. - Look for impossible-travel and new-ASN sign-ins that reuse an existing session rather than performing a fresh authentication.
- For your own apps, offer WebAuthn, bind sessions to device signals, and invalidate all sessions on password or MFA change.
- Block URL shorteners and newly registered domains at the mail and DNS layer where your business can tolerate it.
Related on TechLogHub
- Authentication: factors and why some can be phished
- Clerk vs Auth0: hosted auth platforms with passkey support
- OAuth 2.0: tokens and sessions explained