Tycoon2FA phishing platform returns after recent police disruption
Recorded: March 24, 2026, 2:22 a.m.
| Original | Summarized |
Tycoon2FA phishing platform returns after recent police disruption News Featured Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Microsoft Azure Monitor alerts abused for callback phishing attacks Musician admits to $10M streaming royalty fraud using AI bots FBI links Signal phishing attacks to Russian intelligence services OpenAI rolls out ChatGPT Library to store your personal files Mazda discloses security breach exposing employee and partner data Tycoon2FA phishing platform returns after recent police disruption TeamPCP deploys Iran-targeted wiper in Kubernetes attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityTycoon2FA phishing platform returns after recent police disruption Tycoon2FA phishing platform returns after recent police disruption By Bill Toulas March 23, 2026 The Tycoon2FA phishing-as-a-service (PhaaS) platform that Europol and partners disrupted on March 4 has already returned to previously observed activity levels. AI-generated decoy web pages used in Tycoon2FA attacksSource: CrowdStrike Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Cybercrime Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Microsoft: March Windows updates break Teams, OneDrive sign-ins Microsoft Azure Monitor alerts abused for callback phishing attacks Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Sponsor Posts AI is a data-breach time bomb: Read the new report Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Secure your AI agents without sacrificing speed. Are refund fraud methods targeting your brand? You can monitor the underground for these threats. Overdue a password health-check? Audit your Active Directory for free Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The Tycoon2FA phishing-as-a-service (PhaaS) platform, initially identified by Sekoia approximately two years prior, has resurfaced following a disruption orchestrated by law enforcement, specifically led by Microsoft. This platform, focused on targeting Microsoft 365 and Gmail accounts, utilizes adversary-in-the-middle techniques to bypass two-factor authentication (2FA) protections. Following a takedown operation that seized 330 domains associated with Tycoon2FA’s infrastructure, the platform swiftly returned to operational volume levels, mirroring pre-disruption activity within days, as observed by CrowdStrike. According to CrowdStrike’s report, Tycoon2FA continues to employ largely unchanged tactics, techniques, and procedures (TTPs), facilitating activities such as business email compromise (BEC), email thread hijacking, cloud account takeovers, and the dissemination of malicious SharePoint links. The platform’s prolific nature is evidenced by its generation of approximately 30 million phishing emails per month, representing 62% of all emails blocked by Microsoft. Despite the initial disruption, cybercriminals rapidly established new phishing domains and IP addresses, indicating a partial effectiveness of the takedown. Post-compromise activity observed by CrowdStrike included the creation of inbox rules, hidden folders optimized for fraudulent email storage, and preparations for BEC operations. Notably, a portion of the original infrastructure remained active, suggesting an incomplete disruption, and highlighting the vulnerability of rapidly evolving cybercriminal operations. The ability of operators to quickly recover and replace compromised infrastructure underscores the inherent challenges in combating PhaaS platforms when faced with sustained demand from the broader phishing ecosystem. The report emphasizes that as long as the need for such services persists, the motivation for operators like Tycoon2FA remains unchanged, creating a persistent threat landscape. |