Europol-Coordinated Action Dismantles Tycoon2FA — 330

Europol-Coordinated Takedown Destroys Major MFA-Bypass Phishing Platform

A sweeping international law enforcement and private-sector operation has dismantled Tycoon2FA, one of the most prolific phishing-as-a-service (PhaaS) platforms ever documented. The coordinated action, announced on March 4, 2026, was orchestrated through Europol's Cyber Intelligence Extension Programme (CIEP) with technical disruption executed by Microsoft and a broad coalition of cybersecurity partners.

330 domains — comprising the platform's control panels, reverse-proxy phishing pages, and backend infrastructure — were seized and taken offline. Europol simultaneously coordinated physical operational measures in six countries: Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom.

The operation has also identified Saad Fridi, a Pakistani national, as the platform's primary developer and administrator.

Operation at a Glance

What Was Tycoon2FA?

A Subscription Phishing Factory

Tycoon2FA was a fully commoditized phishing-as-a-service platform available on Telegram for as little as $120 for 10 days of access. The subscription model meant even low-skilled criminal actors could launch highly sophisticated, MFA-bypassing phishing campaigns with no technical expertise required — just a subscription and a target list.

Since launching in August 2023, the platform attracted approximately 2,000 active subscribers and churned through more than 24,000 domains to continuously evade blocklists, threat intelligence feeds, and detection tools.

How the Adversary-in-the-Middle (AiTM) Chain Worked

The platform's defining technical capability was its use of adversary-in-the-middle (AiTM) techniques to defeat multi-factor authentication in real time:

1. Lure delivery: A fraudulent email drives the victim to a convincing phishing page — an exact replica of Microsoft 365, Gmail, or another targeted service
2. Transparent proxy: The phishing page acts as a live relay, forwarding the victim's credentials to the real service in real time
3. OTP capture: As the victim completes MFA (entering their one-time passcode), the platform captures it simultaneously
4. Session cookie theft: The authenticated session cookie generated after successful login is intercepted and forwarded to the attacker
5. Replay access: Attackers replay the captured session cookie to gain full access to the victim's account — MFA has been completely bypassed

This technique renders SMS-based MFA and TOTP authenticator codes ineffective — the attacker receives the session cookie before the victim even realizes they've been phished.

Scale and Impact

Tycoon2FA was a key enabler of initial access for a wide range of downstream attacks. Compromised credentials and session cookies captured through the platform were used to conduct business email compromise (BEC), wire fraud, ransomware deployment, corporate data theft, and account takeover attacks at scale.

The Coalition Behind the Takedown

Europol's Cyber Intelligence Extension Programme (CIEP) served as the intelligence-sharing and operational coordination hub. The operation was notable for the breadth of its public-private partnership:

Law Enforcement

• Europol — coordination and intelligence sharing
• National authorities in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom — domain seizures and operational measures

Private Sector Partners

• Microsoft — technical lead; court-ordered seizure of 330 domains under U.S. District Court (Southern District of New York) authority
• Trend Micro (TrendAI) — threat intelligence and analysis
• Cloudflare — infrastructure visibility and disruption support
• Proofpoint — email threat intelligence
• SpyCloud — credential exposure intelligence
• Intel471 — cybercriminal intelligence
• Coinbase — financial intelligence related to platform payments
• eSentire, Health-ISAC, Crowell, Resecurity, The Shadowserver Foundation — additional intelligence and support roles

Key Suspect

Saad Fridi, identified as the platform's primary developer and administrator, is based in Pakistan. Legal proceedings are ongoing; full arrest or charging details were not confirmed at time of publication.

Recommendations

For Security Teams

1. Deploy phishing-resistant MFA immediately — migrate away from SMS and TOTP to FIDO2/WebAuthn hardware keys (YubiKey, Titan) or passkeys; these are cryptographically bound to the legitimate origin and cannot be relayed by AiTM proxies
2. Implement Conditional Access policies — require device compliance, apply impossible travel detection, and flag new device logins even post-MFA
3. Enable DMARC, DKIM, and SPF enforcement — reduce the volume of fraudulent lure emails reaching users
4. Deploy email link sandboxing — rewrite and analyze URLs at click-time to block phishing pages even after delivery
5. Monitor for anomalous session activity — flag logins from new geolocations, device fingerprints, or IP addresses following successful MFA — this can catch session cookie replay in progress
6. Apply available IOCs — Microsoft and Trend Micro are publishing Tycoon2FA indicators of compromise; apply them across endpoint, network, and email controls

For End Users

1. Never enter credentials by clicking email links — type URLs directly into your browser or use bookmarks
2. Use passkeys where available — Apple, Google, and Microsoft passkeys are phishing-resistant by design
3. Report suspicious authentication prompts immediately to your security team — AiTM attacks often produce subtle visual artifacts
4. Enable session activity alerts on critical accounts (Microsoft 365, Google Workspace) to catch unauthorized access early

Key Takeaways

1. Tycoon2FA targeted 500,000+ organizations monthly — the scale of commoditized PhaaS infrastructure demonstrates that phishing is now industrialized crime-as-a-service
2. 87.5 million phishing messages in four months — this volume is only achievable through automated, subscription-based infrastructure like Tycoon2FA
3. Standard MFA cannot defend against AiTM attacks — TOTP codes and SMS OTPs are capturable in real time; only FIDO2/passkeys are immune
4. $120 subscriptions democratized sophisticated attacks — removing technical barriers means the criminal market for phishing campaigns expands with each new PhaaS platform
5. The public-private coalition model is maturing — Europol's coordination of Microsoft, six national law enforcement agencies, and over a dozen private companies represents a scalable, repeatable disruption framework
6. Platform disruption has limits — 24,000 domains cycled in two years shows the criminal ecosystem's resilience; organizations cannot rely on takedowns as their primary defense

Sources

• Europol-coordinated action disrupts Tycoon2FA phishing platform — BleepingComputer
• Global phishing-as-a-service platform taken down in coordinated public-private action — Europol
• Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale — Microsoft Security Blog
• How a global coalition disrupted Tycoon 2FA — Microsoft On the Issues
• Tycoon 2FA Phishing Platform Dismantled in Global Takedown — SecurityWeek
• Europol, Microsoft, TrendAI and Collaborators Halt Tycoon 2FA Operations — Trend Micro
• Global Takedown Neutralizes Tycoon2FA Phishing Service — Infosecurity Magazine