Tycoon2FA Phishing-as-a-Service Platform Resurgence Following Takedown

Tycoon2FA is a subscription-based phishing-as-a-service (PhaaS) platform that allows cybercriminals to bypass multifactor authentication (MFA) and compromise email accounts using adversary-in-the-middle (AITM) techniques. Europol conducted a technical disruption of Tycoon2FA on March 4, 2026, seizing 330 domains associated with its infrastructure. Despite this takedown, CrowdStrike Falcon Complete Next-Gen MDR and Counter Adversary Operations teams observed a short-term decrease in campaign activity followed by a return to pre-disruption levels, indicating the actors responsible are likely to remain active. In mid-2025, the platform was responsible for 62% of all phishing attempts blocked by Microsoft, generating over 30 million malicious emails in a single month. The platform began its operations in 2023.

Attack Chain

1. Victims receive phishing emails designed to direct them to Tycoon2FA CAPTCHA pages.
2. Upon CAPTCHA validation, the platform steals the victim's session cookies.
3. A JavaScript (JS) file extracts the victim's email addresses.
4. The platform populates fake Microsoft 365 or Google login pages hosted on a Tycoon2FA domain.
5. An obfuscated JS file proxies the victim’s credentials to a legitimate Microsoft 365 cloud account.
6. The attackers authenticate to the victim’s cloud environment using the stolen cookies and credentials.
7. Attackers gain unauthorized access to the victim's email and cloud resources.

Impact

Tycoon2FA has been responsible for a significant volume of phishing attacks, including generating more than 30 million malicious emails in a single month (mid-2025), and was responsible for 62% of all phishing attempts blocked by Microsoft. The platform allows attackers to bypass MFA, leading to compromised email accounts and potential data breaches. Despite the disruption, the platform's activity has returned to pre-disruption levels, indicating a need for continuous monitoring and mitigation strategies. Successful attacks can lead to significant financial loss, data theft, and reputational damage.

Recommendation

• Monitor email traffic for links to newly registered or suspicious domains used in phishing campaigns, utilizing a network connection monitoring system (e.g., firewall logs) to identify connections to domains resembling "Tycoon2FA" mentioned in the overview.
• Implement detection rules to identify the use of stolen session cookies for authentication to cloud environments, focusing on authentication logs (e.g., Azure AD logs, Google Workspace logs).
• Deploy the Sigma rule Detect_Tycoon2FA_Redirect to identify redirects to potential Tycoon2FA landing pages based on URL patterns extracted from the attack chain.
• Monitor for JavaScript execution in web pages that attempts to extract email addresses, using a web application firewall or endpoint detection and response (EDR) solution capable of inspecting client-side scripts.