Tycoon 2FA Phishing Operation Dismantled in Joint Raid by Microsoft and Europol

Microsoft, Europol, and industry partners have successfully dismantled the Tycoon 2FA Phishing-as-a-Service (PhaaS) platform.

Operating since August 2023, this immense adversary-in-the-middle (AiTM) operation allowed cybercriminals to bypass multi-factor authentication (MFA) and infiltrate over 96,000 distinct victims globally.

This coordinated disruption marks a significant blow to the cybercriminal impersonation economy.

Anatomy of the Tycoon 2FA Threat

Tycoon 2FA was engineered to defeat modern security controls by capturing credentials and session cookies in real time.

Sold on Telegram for roughly $120, the toolkit lowered the barrier to entry, enabling low-skilled attackers to hijack authenticated sessions on Microsoft 365 and Google platforms.

The primary developer, identified as Saad Fridi (believed to be operating from Pakistan), ran the platform like a business with partners handling marketing and technical support.

At its peak in mid-2025, the platform drove 62% of all phishing attempts blocked by Microsoft, generating tens of millions of malicious emails per month.

The operation heavily impacted critical infrastructure, compromising hospitals, schools, and universities, which led to delayed patient care and disrupted operations.

Attackers frequently combined Tycoon 2FA with other illicit services, such as the RedVDS virtual infrastructure, to execute mass campaigns.

Threat Intelligence & Attribution	Details
Threat Name	Tycoon 2FA (Tycoon2FA) ​
Attack Type	Phishing-as-a-Service (PhaaS), AiTM, MFA Bypass ​
Primary Operator	Saad Fridi (Attributed to Pakistan) ​
Active Timeline	August 2023 – March 2026
Victimology	96,000+ organizations (Healthcare, Education) ​
Scale	>500,000 targeted orgs/month; 62% of MS blocked phishing ​

Global Takedown and Remediation

Disrupting this borderless threat required unprecedented international collaboration under Europol’s Cyber Intelligence Extension Programme (CIEP).

Armed with a U.S. court order and a $10 million civil complaint filed alongside Health-ISAC, Microsoft seized 330 active domains powering the core infrastructure.

Simultaneously, law enforcement in the UK, Spain, Poland, Latvia, Lithuania, and Portugal executed critical server seizures.

This takedown was driven by extensive private-sector intelligence. TrendAI initiated the investigation, while Proofpoint, Intel 471, and eSentire provided deep threat telemetry.

Cloudflare neutralized international servers, Coinbase traced the movement of stolen cryptocurrency, and the Shadowserver Foundation alerted over 200 global computer emergency response teams to prevent further harm.

Defensive Actions	Mitigation Strategy
Authentication	Enforce strong, phishing-resistant MFA (e.g., FIDO2 hardware keys) ​.
Session Control	Implement strict session lifetime policies and continuous access evaluation ​.
Threat Intelligence	Update network defenses using Tycoon 2FA Indicators of Compromise (IOCs) ​.
Monitoring	Train security teams to detect adversary-in-the-middle (AiTM) reverse proxy tactics ​.

As attackers adapt to these massive infrastructure losses, organizations must continuously harden their identity controls and monitor for stolen session tokens.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.