Tycoon2FA Phishing-as-a-Service Platform Resurgence After Takedown

On March 4, 2026, Europol announced the disruption of Tycoon2FA, a subscription-based PhaaS platform used to bypass MFA and compromise email accounts. The takedown involved seizing 330 domains. Despite this disruption, CrowdStrike observed a short-term decrease in Tycoon2FA activity followed by a return to pre-disruption levels. The actors behind Tycoon2FA have not changed their tactics, techniques, and procedures (TTPs). This suggests a high level of adaptability and persistence, requiring defenders to maintain vigilance. Tycoon2FA was responsible for 62% of phishing attempts blocked by Microsoft in mid-2025, generating over 30 million malicious emails in a single month. The platform began operations in 2023.

Attack Chain

1. Victims receive phishing emails directing them to Tycoon2FA CAPTCHA pages.
2. Upon CAPTCHA validation, the platform steals the victim's session cookies.
3. A JavaScript (JS) file extracts the victim's email address.
4. The victim is presented with a fake Microsoft 365 or Google login page hosted on a Tycoon2FA domain.
5. The victim enters their credentials, which are then proxied to a legitimate Microsoft 365 cloud account via an obfuscated JS file.
6. The attacker authenticates to the victim's cloud environment using the stolen cookies and credentials.
7. The attacker gains access to the victim's email and other cloud services.

Impact

The Tycoon2FA platform has facilitated widespread email account compromise and cloud service breaches. In mid-2025, the platform was responsible for 62% of all phishing attempts blocked by Microsoft, which equated to over 30 million malicious emails in a single month. Successful attacks can lead to data theft, financial fraud, and further compromise of internal systems. Despite law enforcement actions, the platform's rapid resurgence indicates its operators are highly resilient and capable of quickly restoring their infrastructure.

Recommendation

• Monitor network traffic for connections to known Tycoon2FA domains identified in the IOC table to detect ongoing phishing campaigns.
• Implement the provided Sigma rule to detect suspicious JavaScript activity associated with credential harvesting from fake login pages, and tune the rule for your environment.
• Review and enhance MFA implementation across all cloud services, as Tycoon2FA is designed to bypass standard MFA protocols.
• Implement the provided Sigma rule to detect cookie theft attempts, focusing on events where cookies are exfiltrated after CAPTCHA validation.
• Educate users about phishing tactics, including the use of CAPTCHA pages and fake login portals, to reduce susceptibility to Tycoon2FA campaigns.