Microsoft and partners disrupt Tycoon 2FA phishing service

Microsoft, Europol and industry partners announced a disruption of Tycoon 2FA on 4 March. Microsoft said a US court order enabled the seizure of 330 active domains used by the service’s control panels and fake sign-in pages. The company’s account describes coordinated action across several European jurisdictions.

Active since at least 2023, the service helped criminals impersonate users of Microsoft 365, Outlook and Gmail. Microsoft said it was designed to get around additional protections, including multifactor authentication, by capturing account credentials and session tokens.

Microsoft linked Tycoon 2FA to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers. These are the company’s estimates, not a count independently established by Capvise.

Healthcare and education were prominent among affected sectors. Health-ISAC joined the case as a co-plaintiff. The operation targeted shared infrastructure supporting account takeovers; Microsoft did not present the domain seizures as proof that every user’s compromised account had been recovered.