A global operation led by Microsoft and Europol has disrupted Tycoon 2FA, one of the most widely used phishing services for bypassing multifactor authentication (MFA) for email and online service accounts. The operation has significant implications for customer experience teams responsible for protecting digital accounts.
The takedown targeted infrastructure that the service uses to impersonate legitimate users and gain access to online services, sending tens of millions of fraudulent emails reaching over 500,000 organizations each month worldwide. The scale indicates how phishing operations increasingly threaten the trust layer between enterprises and their customers.
Phishing Service Put Customer Accounts and Digital Trust At Risk
Tycoon 2FA had been active since around 2023, enabling cybercriminals to intercept authentication sessions in real time, capturing one-time passcodes and session cookies that allow attackers to log in as legitimate users without triggering alerts, even on protected accounts.
Tycoon 2FA combined convincing phishing templates, realistic landing pages, and real‑time capture of credentials and authentication codes into an easy‑to‑use package that scaled quickly.
Steven Masada, Assistant General Counsel, Microsoft’s Digital Crimes Unit, wrote in a blog post:
“By mid‑2025, Tycoon 2FA accounted for approximately 62 percent of all phishing attempts Microsoft blocked, including more than 30 million emails in a single month. That placed Tycoon 2FA among the largest phishing operations globally.”
The service provided ready-made phishing templates and dashboards that made sophisticated impersonation campaigns accessible to thousands of attackers.
Tycoon 2FA has been linked to more than 96,000 phishing victims globally, including over 55,000 Microsoft customers, according to Masada. In the UK alone, authorities identified roughly 5,350 victims connected to the service.
Organizations across healthcare, education, business and the public sector were targeted.
Those numbers reflect account trust failures that customers experience directly.
Attackers gaining access to email or cloud accounts often results in breakdowns in customer service, from unauthorized transactions and locked accounts to fraudulent messages sent in their name or sensitive information exposed.
As part of the operation, Microsoft seized 330 active domains powering Tycoon 2FA’s infrastructure, including phishing pages and control systems used by attackers. The company acted under a court order from the U.S. District Court for the Southern District of New York, and in coordination with Europol’s Cyber Intelligence Extension Programme (CIEP).
The disruption was carried out with support from industry partners including Cloudflare, Coinbase, Proofpoint, Intel 471, TrendAI, Shadowserver Foundation, Resecurity, eSentire and Health-ISAC.
The CIEP framework aims to bring public- and private‑sector organizations together to go beyond sharing intelligence to taking coordinated action across borders.
Law enforcement across several European countries also carried out infrastructure seizures and other operational actions tied to the service. Masada noted:
“Taking this infrastructure offline cuts off a major pipeline for account takeovers and helps protect people and organizations from follow‑on attacks such as data theft, ransomware, business email compromise, and financial fraud.”
Investigators indicate Tycoon 2FA functioned as a service within a broader underground ecosystem.
