Tycoon 2FA - Adversary Tactics Persist Post Takedown

The Threat

Tycoon 2FA is a phishing-as-a-service (PhaaS) platform that has been operational since 2023. Despite a significant international law enforcement takedown, its operations have resumed to pre-disruption levels. According to CrowdStrike, this platform was responsible for 62% of phishing attempts blocked by Microsoft in 2025, showcasing its extensive reach and impact on cybersecurity.

In early March, a coordinated effort by Europol and Microsoft led to the seizure of 330 active Tycoon 2FA domains. However, this takedown only temporarily disrupted the service. Within days, Tycoon 2FA's activity returned to normal, indicating its resilience and the ongoing threat it poses to organizations worldwide.

Who's Behind It

The Tycoon 2FA platform is utilized by cybercriminals to execute sophisticated phishing attacks. It allows attackers to bypass multi-factor authentication (MFA) and compromise user accounts without triggering alerts. This service has generated over 30 million malicious emails monthly, targeting around 500,000 organizations. The platform has been linked to approximately 96,000 distinct phishing victims globally, highlighting its extensive operational network.

CrowdStrike's analysis reveals that the tactics, techniques, and procedures (TTPs) used by Tycoon 2FA have not changed post-takedown. This indicates a robust operational structure that may continue to evolve despite law enforcement efforts.

Tactics & Techniques

Tycoon 2FA employs various tactics to execute its phishing campaigns. These include:

• Phishing emails that lead to malicious CAPTCHA pages.
• Session cookie theft upon CAPTCHA validation.
• Use of JavaScript files for email address extraction.
• Credential proxying via malicious scripts.
• Accessing victims' cloud environments using stolen credentials.

Additionally, the platform has been involved in business email compromise (BEC) phishing, email thread hijacking, and cloud account takeover attacks. CrowdStrike noted that even after the takedown, some phishing attacks were still attempted using domains not affected by law enforcement actions.

Defensive Measures

While the takedown of Tycoon 2FA domains may have had a temporary impact, organizations must remain vigilant. Cybersecurity teams should enhance their monitoring and response strategies to detect and mitigate phishing attempts effectively. Here are some recommended actions:

• Educate employees about phishing tactics and how to recognize suspicious emails.
• Implement robust multi-factor authentication across all accounts to add an extra layer of security.
• Regularly update and patch systems to protect against known vulnerabilities.
• Utilize advanced threat detection tools to identify and block phishing attempts before they reach users.

The resilience of Tycoon 2FA serves as a reminder that cybersecurity is an ongoing battle. Continuous vigilance and proactive measures are essential to safeguard against evolving threats.