Tycoon 2FA phishing-as-a-service platform disrupted globally
Tycoon 2FA, a phishing-as-a-service platform that bypassed multifactor authentication to enable account takeovers, was disrupted in March 2026 through coordinated action by Microsoft, Europol, and private security firms. The platform had targeted approximately 96,000 victims across healthcare and education sectors and reached over 500,000 organizations monthly.
What happened
Tycoon 2FA is a phishing-as-a-service (PhaaS) platform that operated as an adversary-in-the-middle (AiTM) phishing kit, harvesting usernames, passwords, and Microsoft 365 and Gmail session cookies to enable account takeover even when multifactor authentication was enabled. The platform was launched in August 2023 and sold by subscription starting at $120 for 10 days.
In February 2026, Tycoon 2FA infrastructure was disrupted in collaboration with public and private partners including Microsoft, Europol, Proofpoint, Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel 471, Resecurity, The Shadowserver Foundation, SpyCloud, and TrendAI. Law enforcement in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom carried out seizures of infrastructure and operational measures.
Reported impact
In 2025, Tycoon 2FA was responsible for 62% of all phishing attempts blocked by Microsoft, representing more than 30 million emails in a single month. The service was linked to approximately 96,000 distinct phishing victims worldwide since its launch, including more than 55,000 Microsoft customers, and reached over 500,000 organizations each month globally.
Healthcare and education sectors were particularly targeted. Microsoft cited cases in New York where hospitals, schools and universities suffered compromises, resulting in operational disruptions and delays in patient care.
Index analysis
Tycoon 2FA was the highest volume adversary-in-the-middle phishing threat in Proofpoint visibility. In February 2026, Proofpoint observed over three million messages associated with Tycoon 2FA.
Governance controls
Microsoft and Health-ISAC filed a lawsuit in the United States Southern District of New York against alleged Tycoon 2FA creator Saad Fridi and unnamed associates. The disruption action was coordinated through Europol's Cyber Intelligence Extension Programme (CIEP), which facilitated cooperation between law enforcement agencies across multiple countries.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.