Europol Coalition Dismantles Tycoon 2FA Phishing Platform That Bypassed MFA at 500,000 Organizations Monthly
A coordinated operation led by Europol, Microsoft, and law enforcement agencies across six countries seized 330 domains powering the Tycoon 2FA phishing-as-a-service platform, which had accounted for 62 percent of all phishing attempts Microsoft blocked by mid-2025.
A global coalition of law enforcement agencies and cybersecurity firms dismantled Tycoon 2FA, one of the most prolific phishing-as-a-service platforms in operation, after seizing 330 domains that formed the core of its infrastructure. The March 4 operation, coordinated through Europol’s European Cybercrime Centre, targeted a platform that had been sending tens of millions of fraudulent emails to more than 500,000 organizations monthly by mid-2025 and had compromised accounts at an estimated 96,000 organizations worldwide since its emergence in August 2023.
Microsoft’s Digital Crimes Unit led the technical disruption after a U.S. District Court for the Southern District of New York issued a seizure order on February 26, 2026, granting the company legal authority to take control of the domains. Health-ISAC, a cybersecurity information-sharing organization for the healthcare sector, served as co-plaintiff in the civil complaint.
How Tycoon 2FA Defeated Multi-Factor Authentication
Tycoon 2FA operated as an adversary-in-the-middle platform, using reverse proxy servers to sit between victims and legitimate login pages for services including Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail. When a victim entered credentials on a convincing phishing page, the platform captured both the password and the authentication code in real time, relaying them through the proxy to complete the login on the real service. The technique allowed attackers to obtain valid session cookies, effectively bypassing multi-factor authentication without triggering security alerts.
The platform was sold as a subscription service through Telegram and Signal, starting at 120 dollars for 10 days of access or 350 dollars per month for a web-based administration panel. Subscribers received pre-built phishing templates, domain and hosting configuration tools, attachment generators, and redirect logic, lowering the technical barrier for conducting sophisticated credential theft campaigns.
Scale of the Operation
By mid-2025, Tycoon 2FA had grown to account for approximately 62 percent of all phishing attempts that Microsoft blocked, making it the single largest source of phishing traffic the company tracked. At its peak in November 2025, Microsoft blocked more than 30 million emails in a single month originating from the platform’s infrastructure.
The impact extended across sectors. More than 55,000 Microsoft customers were successfully phished during the platform’s operational period, along with over 100 members of Health-ISAC. In New York alone, at least two hospitals, six municipal schools, and three universities were among the confirmed targets. Education and healthcare organizations were disproportionately affected, consistent with the sectors’ historically lower investment in identity security infrastructure.
Civil Complaint and Attribution
Microsoft and Health-ISAC filed a civil complaint against Saad Fridi, believed to be based in Pakistan and identified as the platform’s primary developer, along with four unnamed associates. The complaint seeks a 10 million dollar injunction. Microsoft’s threat intelligence team tracks the group behind the platform as Storm-1747. Fridi allegedly operated under the handles “SaaadFridi” and “Mr_Xaad,” with partners handling marketing, payments, and technical support.
No criminal arrests have been announced as part of the operation. The action relied on civil litigation and infrastructure seizure rather than extradition or criminal prosecution, a model Microsoft has employed in previous disruptions targeting botnets and phishing networks.
International Law Enforcement Coalition
The operation brought together law enforcement agencies from Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom, coordinated through Europol’s Cyber Intelligence Extension Programme. On the private sector side, the coalition included Cloudflare, Coinbase, eSentire, Intel 471, Proofpoint, Resecurity, the Shadowserver Foundation, SpyCloud, and Trend Micro, which provided the initial intelligence that led to the investigation.
The Tycoon 2FA disruption is the latest in a series of takedowns targeting phishing infrastructure over the past 18 months. Microsoft has previously disrupted the Lumma Stealer, RaccoonO365, and fake ONNX platforms, and the RedVDS bulletproof hosting service has lost 95 percent of its infrastructure since January 2026. The cumulative effect of these operations has been to raise the cost and complexity of operating phishing-as-a-service platforms, though security researchers caution that the underlying adversary-in-the-middle technique remains widely available and new platforms typically emerge within weeks of a takedown.