Tycoon2FA Returns: PhaaS Platform Survives Law Enforcement Disruption

Key Takeaways

• On March 4, 2026, a Europol-coordinated coalition seized 330 domains and disrupted the Tycoon2FA phishing-as-a-service platform, which had enabled over 64,000 large-scale phishing campaigns and reached more than 500,000 organizations worldwide since August 2023 [1][2].
• CrowdStrike observed campaign volumes returning to pre-disruption levels within days, and by March 23, 2026, Tycoon2FA had fully resumed normal operations without any arrests of its operators [3][1].
• Tycoon2FA functions as a synchronous adversary-in-the-middle (AiTM) reverse proxy, enabling criminal subscribers to intercept MFA codes and session cookies in real time, making conventional time-based OTP and push-notification MFA ineffective against the attack [2][4].
• FIDO2 hardware security keys and passkeys are among the most accessible phishing-resistant authentication methods and represent the recommended path forward for organizations seeking to defend against AiTM-class attacks. Unlike time-based OTP and push-notification MFA, phishing-resistant methods perform a cryptographic challenge-response bound to the origin domain; a reverse-proxy operating at a different domain cannot complete this handshake on the victim’s behalf [5].
• The rapid recovery of Tycoon2FA is structurally predictable: without arrests and without dismantling the economic model that makes PhaaS viable, infrastructure seizures produce temporary disruptions rather than durable takedowns, a pattern now documented across multiple MaaS platforms [3][6].

Background

Tycoon2FA is a subscription-based phishing-as-a-service platform that enables criminal affiliates — regardless of technical skill — to conduct adversary-in-the-middle phishing campaigns capable of defeating most forms of multifactor authentication. The platform first emerged in August 2023, with its earliest registered domain appearing on July 29, 2023 [4]. Sekoia’s Threat Detection and Research team identified and documented the platform in October 2023 through routine threat hunting, detecting over 1,100 associated domain names within the first several months of the platform’s operation [4]. By the time of the March 2026 law enforcement action, more than 24,000 distinct domains had been deployed in support of Tycoon2FA’s infrastructure [2].

Microsoft tracks the platform’s operator as Storm-1747, a financially motivated threat actor using the handles “SaaadFridi,” “Mr_Xaad,” and “Tycoon Group” on Telegram [2][4]. The operator is assessed to have evolved the platform from an earlier phishing kit called Dadsec (also known as OTT), transitioning from web defacement activity into the more lucrative subscription-based phishing toolkit market [4]. The platform is distributed exclusively through private Telegram channels that function as customer portals, complete with versioned changelogs, credential alert bots, and responsive customer support.

Pricing ranged from approximately $120 for ten-day access to $350 for monthly subscriptions, with pricing structures varying by the top-level domain selected for phishing infrastructure [4]. Blockchain analysis of Bitcoin wallets associated with the operation identified nearly $400,000 in transactions, reflecting a conservative floor on revenue rather than a full accounting [4]. At its peak, Tycoon2FA had roughly 2,000 active criminal subscribers, generated more than 30 million phishing emails in a single month, and reached over 500,000 organizations worldwide each month [2]. According to Microsoft telemetry, Tycoon2FA accounted for approximately 62% of all phishing attempts blocked by Microsoft by mid-2025, and in January 2025 it represented 89% of PhaaS incidents observed across security vendor telemetry [2][4] — the clearest available measure of the platform’s scale at the time of law enforcement action.

Security Analysis

How Tycoon2FA Bypasses MFA

Unlike traditional credential-harvesting phishing pages that present a static replica of a login form and simply capture whatever the victim types, Tycoon2FA operates as a dynamic reverse proxy. When a victim navigates to a Tycoon2FA-controlled phishing domain, the platform relays the connection in real time to the genuine identity provider — Microsoft 365, Google Workspace, Okta, or others — fetching and presenting the actual login interface [2][4]. Every interaction the victim completes with what appears to be their legitimate sign-in page is transparently proxied through Tycoon2FA’s infrastructure.

This proxy architecture is what makes the MFA bypass possible. When the identity provider sends a time-based one-time password challenge or a push notification to the victim, the victim completes the challenge against the real provider through the Tycoon2FA relay. The provider, receiving a valid MFA response, issues a session cookie and authentication token. Tycoon2FA intercepts this token before relaying the authenticated session to the victim, silently acquiring a valid credential artifact that can be replayed independently [2][4]. The victim experiences a normal login sequence. The attacker receives a stolen session cookie with access to the victim’s authenticated session, potentially enabling access to email, files, and connected cloud services without requiring re-authentication [2][4].

To prevent automated analysis from detecting the phishing infrastructure, Tycoon2FA incorporates multiple evasion techniques. Visitors encounter a Cloudflare Turnstile CAPTCHA gate that blocks automated scanners [4]. The malicious JavaScript payload is encoded in base64 and XOR operations and decoded only at runtime; invisible Hangul Filler Unicode characters are used to conceal JavaScript logic within the page source [4]. The phishing page deletes itself from the DOM after execution to evade signature-based analysis, and CSS resource files are requested under benign names mimicking legitimate CDN assets [4]. Rather than transmitting captured credentials over conventional HTTP POST requests, Tycoon2FA uses WebSocket connections for real-time credential relay, reducing the network-layer detection signatures that endpoint security tools might otherwise catch [4].

The attacker’s subscriber dashboard provides granular, per-campaign visibility into the captured data, including fields for targeted service, browser type, victim location, and authentication status. Credentials captured through valid logins, SSO flows, and invalid attempts are each tracked and categorized [4]. The platform’s operational telemetry and subscriber dashboard represent engineering investment substantially beyond commodity phishing tools.

The March 4, 2026 Disruption

On March 4, 2026, Europol’s European Cybercrime Centre coordinated the seizure of 330 Tycoon2FA domains through a U.S. District Court order for the Southern District of New York [1][2]. The action drew on a coalition of twelve private sector partners: Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel471, Microsoft, Proofpoint, Resecurity, The Shadowserver Foundation, SpyCloud, and Trend Micro (TrendAI) [1][2]. Law enforcement action was coordinated across Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom [1].

The scope of contributing actions was significant. Cloudflare removed thousands of domains and Workers projects associated with the platform, terminated attacker accounts, and replaced seized infrastructure with security alert interstitial pages [7]. The Shadowserver Foundation distributed a specialized disruption report covering 8,702 domains and 6,754 unique IPs to 237 National CSIRTs globally [8]. Microsoft provided the underlying threat intelligence and legal mechanism, having published the definitive technical analysis of Tycoon2FA’s inner workings concurrent with the takedown announcement [2]. Trend Micro had been gathering sufficient attribution data since November 2025 to link infrastructure and tooling to specific threat actors [9].

The disruption represented one of the more extensively coordinated PhaaS takedown efforts observed in the 2024–2026 period, involving twelve private sector partners and coordinated law enforcement actions across six countries [1][2]. The 330 seized domains represented Tycoon2FA’s active command-and-control and credential-capture infrastructure, and the Shadowserver Foundation additionally registered expired C2 and campaign domains to prevent their re-registration by the operators [8]. The breadth of the action — covering domains, infrastructure, Workers projects, and global CSIRT notification — suggests the coalition was targeting operational capacity rather than individual campaign pages.

The Rapid Resurrection

The disruption did not hold. CrowdStrike’s Falcon Complete team observed campaign volumes fall to approximately 25% of pre-disruption levels on March 4–5, but by the following days, activity began recovering. Within the week, Tycoon2FA had returned to pre-disruption operational levels [3][1]. By March 23, 2026, independent security researchers confirmed the platform had fully resumed normal operations with no meaningful sustained reduction in threat activity [1].

Several structural factors explain the speed of recovery. The 330 seized domains, while representing the platform’s most active infrastructure, comprised a small fraction of the over 24,000 domains Tycoon2FA had registered and operated across its lifespan [2][3]. Peripheral phishing domains hosted on third-party infrastructure survived the seizure intact. CrowdStrike observed eight newly acquired IPv6 addresses appearing by March 2, 2026 — before the public announcement — suggesting that operators had begun shifting infrastructure in anticipation of or concurrent with law enforcement action [3]. At least one legacy IP address persisted from January 9, 2026, indicating that portions of the original infrastructure were never captured [3]. Domain registration for credential-harvesting pages showed no meaningful reduction throughout the disruption window, according to CrowdStrike’s monitoring [3].

Critically, no arrests were made and no operators were physically detained. The speed of recovery suggests that the financial and technical resources of the operation remained largely intact — the subscription-funded infrastructure model appears to have absorbed domain replacement costs without significant disruption [3]. Monthly subscription pricing of up to $350 generates recurring revenue that makes infrastructure replacement a routine operational expense [4]. Without incapacitating the human operators or the economic model, the domain seizure functioned primarily as a temporary operational inconvenience rather than a durable disruption.

The Tycoon2FA operation also benefits from a hybrid infrastructure arrangement with a related platform called Salty2FA. Security researchers observed Tycoon2FA and Salty2FA operating as a deliberate failover system: when Salty2FA’s primary domains failed DNS resolution, hardcoded fallback scripts fetched payloads from Tycoon2FA infrastructure [3]. This redundancy engineering, analogous to fault-tolerant distributed systems design, means that even partial takedowns of either platform degrade but do not disable the attacker’s operational capability.

A Pattern Across MaaS Platforms

Tycoon2FA’s resilience is not anomalous; it is illustrative of a systemic challenge in disrupting MaaS platforms through infrastructure seizure alone. The May 2025 takedown of the Lumma Stealer malware-as-a-service operation, conducted through a coordinated international coalition, resulted in the malware’s resurfacing within weeks, with operators re-establishing distribution channels on Russian-language criminal forums [6]. The LabHost PhaaS platform, taken down in 2024, was followed by reported growth in competing platforms, suggesting that displaced subscribers migrated to successor services [6]. Each takedown generates valuable intelligence and provides temporary relief to targeted organizations, but the criminal market responds by distributing capability across a wider set of competing platforms and hardening infrastructure against future seizures.

The economics of PhaaS amplify this resilience. Subscription pricing in the range of $120–$350 per month reduces the technical and financial barrier to sophisticated phishing to a level accessible to low-skill threat actors [4]. A single successful account takeover at a financial institution or cloud service provider can generate returns many times the subscription cost. Affiliates who are displaced when a platform is disrupted have strong incentives to quickly migrate to the next available service, sustaining demand that drives rapid platform reconstitution. The market for PhaaS services is now sufficiently mature that operators compete on feature sets, customer support quality, and evasion capability — commercial dynamics that do not respond to supply-side enforcement in isolation.

Recommendations

Immediate Actions

Organizations whose identity infrastructure is accessible to phishing should audit their MFA deployment against the specific threat model that AiTM platforms like Tycoon2FA represent. Any authentication factor that requires the user to enter a code or approve a push notification is subject to real-time interception through a reverse-proxy architecture. Time-based one-time passwords (TOTP), SMS codes, and standard push-to-approve notifications all fall into this category. Defenders should not interpret the presence of MFA as protection against this attack class without confirming that the specific MFA method in use has cryptographic binding to the destination domain.

Security operations teams should review Microsoft Entra ID sign-in logs for anomalous session token usage patterns: logins from unexpected IP addresses or geographies that occur immediately after a successful MFA event, particularly from IPv6 space associated with hosting providers such as M247 Europe SRL, which CrowdStrike identified as a source of automated login activity following Tycoon2FA campaigns [3]. Session token theft typically manifests as replayed access that originates from infrastructure distinct from the victim’s normal access patterns, because the attacker replays the stolen cookie from their own systems. Password resets do not revoke stolen session tokens; explicit session invalidation through the revokeSignInSessions administrative action in Microsoft Entra ID is required [5].

Short-Term Mitigations

The most direct technical control against AiTM phishing is deploying FIDO2 hardware security keys or device-bound passkeys as the required authentication method for all user populations. FIDO2 authentication performs a cryptographic challenge-response bound to the origin domain; a phishing proxy operating at a different domain cannot complete this handshake on the victim’s behalf, causing authentication to fail at the protocol level regardless of the attacker’s sophistication [5]. Microsoft Entra ID supports enforcing phishing-resistant MFA through Authentication Strength Conditional Access policies that can be applied to all users or scoped to privileged roles as a starting point.

Conditional Access policies should be extended to require managed, compliant devices for all cloud resource access. When authentication is restricted to devices enrolled in corporate device management and bearing a device compliance certificate, stolen session cookies replayed from attacker-controlled infrastructure cannot satisfy the device compliance requirement and will be blocked before granting access [5]. Organizations should complement this with token lifetime policies that minimize the window of utility for stolen refresh tokens, and with continuous access evaluation (CAE) configurations that revoke access in near-real time when anomalies are detected on active sessions.

Email security controls provide a complementary layer. Anti-phishing policies in Microsoft Defender for Office 365 blocked over 13 million Tycoon2FA-linked malicious emails in October 2025 alone [2]. Organizations should verify that advanced anti-phishing policies are enabled and that safe links URL rewriting is active, including for links in internal email where compromised accounts may serve as a propagation vector for subsequent phishing within the organization.

Strategic Considerations

The Tycoon2FA disruption and resurrection reinforces an emerging pattern in MaaS takedown operations: infrastructure-only actions against well-capitalized platforms produce temporary disruptions rather than durable outcomes, and concurrent action against human operators and financial infrastructure appears necessary to achieve lasting effects [3][6]. Organizations and policymakers should calibrate expectations for law enforcement disruptions accordingly, treating them as one component of a broader threat reduction effort rather than as resolutions that eliminate the underlying threat.

Strategically, security teams should adopt an assume-breach posture toward MFA at the organizational level, treating authentication success as a necessary but not sufficient condition for access authorization. This shift has architectural implications: it drives investment in post-authentication monitoring, behavioral analytics on authenticated sessions, identity security posture management (ISPM) tooling, and Zero Trust network segmentation that limits what an attacker can reach even after obtaining valid session credentials. The value of MFA as a control does not diminish, but its role changes from a final defensive barrier to one layer in a defense-in-depth architecture that assumes the barrier will occasionally fail.

Security vendors participating in the Tycoon2FA coalition have indicated that attribution data was sufficient, by November 2025, to connect infrastructure and tooling to specific threat actors [9]. Organizations should support and participate in threat intelligence sharing programs — particularly sector-specific ISACs — that enable the kind of coordinated pre-enforcement intelligence gathering that made the March 2026 action possible, even if the disruption proved temporary. Collective defense through shared indicators of compromise, including Tycoon2FA campaign domains, IP ranges, and WebSocket exfiltration signatures, reduces the mean time to detection for individual organizations and increases the cost of operations for the threat actor.

CSA Resource Alignment

The Tycoon2FA case directly engages several areas of CSA guidance. The AI Controls Matrix (AICM) — the CSA’s superset framework encompassing the Cloud Controls Matrix (CCM) — addresses identity and access management controls (IAM domain) including MFA requirements, session management, and privileged access governance [10]. The AICM’s IAM controls should be reviewed in light of the demonstrated inadequacy of OTP-based MFA against AiTM platforms; control language referencing “multifactor authentication” may require annotation or supplementary guidance specifying that phishing-resistant methods are required for high-sensitivity access.

CSA’s Zero Trust guidance is directly applicable to the post-authentication monitoring posture described in this note. The Zero Trust principle of never implicitly trusting an authenticated identity — requiring continuous verification of device health, session context, and behavioral patterns — addresses precisely the failure mode that AiTM attacks exploit: a system that grants persistent trust after a single successful authentication event [11]. Organizations implementing Zero Trust architectures that enforce per-request or per-session contextual verification are more resilient against stolen session cookie replay, because device compliance requirements and continuous access evaluation can block replay attempts originating from attacker-controlled infrastructure even with a valid session token [5][11].

The CSA’s AI Organizational Responsibilities publications address governance structures for security operations that are increasingly AI-assisted [12]. Adversary use of AI to improve phishing lure quality and email deliverability represents an emerging threat vector that organizations governing AI adoption should monitor, as the capability bar for sophisticated phishing infrastructure continues to fall. Organizations governing AI adoption in their own environments should account for the use of AI by adversaries in lowering the barrier to sophisticated phishing as part of their threat modeling.

CSA’s STAR Program enables organizations to assess cloud service provider security posture against CCM and AICM controls. In evaluating identity and access management capabilities of cloud services, organizations should specifically assess provider support for FIDO2 authentication, Conditional Access on device compliance, continuous access evaluation, and session revocation APIs as first-order criteria in light of the PhaaS threat landscape.

References

[1] Bill Toulas, “Tycoon2FA phishing platform returns after recent police disruption,” BleepingComputer, March 23, 2026. https://www.bleepingcomputer.com/news/security/tycoon2fa-phishing-platform-returns-after-recent-police-disruption/

[2] Microsoft Security Blog, “Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale,” Microsoft, March 4, 2026. https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/

[3] CrowdStrike, “Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown,” CrowdStrike Blog, March 2026. https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/

[4] Sekoia Threat Detection & Research Team, “Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit,” Sekoia Blog, 2024–2025. https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/

[5] Microsoft Security Blog, “Defending the gates: How a global coalition disrupted Tycoon 2FA,” Microsoft On the Issues, March 4, 2026. https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/

[6] Risk Insights Hub, “Lumma Infostealer Takedown Lessons,” May 2025. https://www.riskinsightshub.com/2025/05/lumma-infostealer-takedown-lessons.html

[7] Cloudflare Threat Intelligence, “Tycoon 2FA Takedown,” Cloudflare, March 2026. https://www.cloudflare.com/threat-intelligence/research/report/tycoon-2fa-takedown/

[8] Shadowserver Foundation, “Tycoon 2FA Phishing-as-a-Service Disruption,” Shadowserver, March 4, 2026. https://www.shadowserver.org/news/tycoon-2fa-phishing-as-a-service-disruption/

[9] Trend Micro, “Europol, Microsoft, TrendAI, and Collaborators Halt Tycoon 2FA Operations,” Trend Micro Research, March 2026. https://www.trendmicro.com/en_us/research/26/c/tycoon2fa-takedown.html

[10] Cloud Security Alliance, “AI Controls Matrix (AICM),” CSA, 2025. https://cloudsecurityalliance.org/research/working-groups/ai-controls-matrix

[11] Cloud Security Alliance, Zero Trust Guidance, CSA. https://cloudsecurityalliance.org/zt

[12] Cloud Security Alliance, “AI Organizational Responsibilities: Core Security Responsibilities,” CSA, 2024. https://cloudsecurityalliance.org/research/working-groups/ai-organizational-responsibilities