Tycoon2FA Phishing-as-a-Service Platform Resurgence

The Tycoon2FA PhaaS platform, disrupted by Europol on March 4, 2026, has demonstrated resilience by quickly returning to pre-disruption levels of activity. This platform, active since 2023, facilitates MFA bypass and email account compromise through adversary-in-the-middle (AITM) techniques. In mid-2025, it was responsible for 62% of phishing attempts blocked by Microsoft. Despite the takedown of 330 domains comprising its infrastructure, the platform's core TTPs remain consistent, indicating that the actors behind Tycoon2FA are likely to persist as a threat. Defenders must maintain vigilance to detect and mitigate the continued risk posed by this PhaaS platform.

Attack Chain

1. Victims receive phishing emails designed to lure them to Tycoon2FA CAPTCHA pages.
2. Upon CAPTCHA validation, a JavaScript file is used to extract the victim's email address.
3. The victim is redirected to a fake Microsoft 365 or Google login page hosted on a Tycoon2FA domain.
4. The fake login page prompts the victim for their credentials, which are then captured by the attacker.
5. The captured credentials are proxied to a legitimate Microsoft 365 cloud account via an obfuscated JS file.
6. The attacker steals session cookies upon CAPTCHA validation.
7. Using the stolen cookies and credentials, the attacker authenticates to the victim's cloud environment.
8. The attacker gains unauthorized access to the victim's email account and can perform actions such as reading emails, sending emails, and exfiltrating data.

Impact

The Tycoon2FA platform enables cybercriminals, even those with minimal technical skills, to conduct sophisticated phishing campaigns and bypass MFA. In mid-2025, the platform was responsible for 62% of all phishing attempts blocked by Microsoft and purportedly generated over 30 million malicious emails in a single month. Successful attacks can lead to unauthorized access to sensitive information, financial loss, and reputational damage. The resurgence of Tycoon2FA after the takedown underscores the adaptability and persistence of modern adversaries.

Recommendation

• Monitor network traffic for connections to newly registered domains similar to those used by Tycoon2FA to detect potential phishing attempts, focusing on the domains used to host fake Microsoft 365 or Google login pages as mentioned in the Attack Chain.
• Implement and tune the Sigma rule "Detect Tycoon2FA PhaaS CAPTCHA Page Redirection" to identify instances where users are being redirected to potential phishing pages.
• Implement and tune the Sigma rule "Detect Tycoon2FA Cookie Theft" to detect the exfiltration of cookies as mentioned in the Attack Chain.
• Investigate any alerts generated by the above rules, prioritizing users who have recently validated a CAPTCHA.
• Monitor cloud environment logs for suspicious login activity using stolen cookies and credentials.