Phishing gang Tycoon2FA dismantled, targeted Microsoft 365 and Gmail
Europol and law enforcement partners dismantled the cybercriminal group Tycoon2FA, which operated a phishing-as-a-service platform targeting Microsoft 365 and Google services. The group was reportedly responsible for approximately 96,000 phishing victims since 2023, with particular impact on healthcare and education sectors.
What happened
Europol, working with the UK National Crime Agency, Cloudflare, Microsoft, Proofpoint, and Trend Micro, dismantled the cybercriminal group Tycoon2FA and shut down 330 domains used by the group. Tycoon2FA began operations in summer 2023 and offered phishing toolkits and services to other attackers, including features to bypass multi-factor authentication.
According to Microsoft, by mid-2025, Tycoon2FA accounted for approximately 62% of phishing attempts Microsoft blocked. The group had approximately 2,000 active subscribers (attackers) at the time of the takedown. Trend Micro identified the service developer and key operator, Saard Fridy, in November 2025.
Reported impact
Approximately 96,000 phishing victims were attributed to Tycoon2FA since 2023, with about 55,000 being Microsoft users. In the UK alone, over 5,000 users fell victim to Tycoon2FA attacks. Healthcare and education institutions were particularly targeted.
Index analysis
Tycoon2FA operated as a Phishing-as-a-Service (PhaaSs) provider, lowering technical barriers to entry for attackers and enabling more sophisticated campaigns. Other similar services include BlackForce, GhostFrame, and InboxPrime AI, which uses generative AI to mimic human behavior in phishing emails.
Microsoft reported blocking over 13 million emails related to specific PhaaSs services in late 2025 alone. Attacks on Microsoft 365 environments include domain spoofing, account compromise, OAuth token theft, and malware distribution via collaboration tools.
Governance controls
Trend Micro tracked Tycoon2FA's activities over an extended period before identifying key operators and sharing information with Europol. However, the group's distributed infrastructure means complete elimination of all operations may be difficult, and the group may resume under a different name.
Organizations are advised to implement strong authentication mechanisms, strict access controls, real-time detection of malicious URLs, and employee training on phishing. Microsoft Defender alone has limitations against business email compromise and other sophisticated tactics.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.