Skip to content
HACKTECH
Cloud & identityReported Published 3 sources

Microsoft and Europol disrupt Tycoon 2FA, an MFA-bypass phishing-as-a-service platform

On 4 March 2026 Microsoft, acting under a US court order and for the first time in coordination with Europol's Cyber Intelligence Extension Programme, seized 330 domains that powered Tycoon 2FA, an adversary-in-the-middle phishing-as-a-service platform that captured credentials and session cookies and relayed MFA codes to break into accounts on services including Microsoft 365, Outlook and Gmail. Law enforcement in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom seized infrastructure, partners including Cloudflare, Proofpoint and Health-ISAC supported the action, and Europol said the investigation began with intelligence shared by Trend Micro. Microsoft said the service was responsible for tens of millions of fraudulent emails reaching over 500,000 organisations each month. Its Q1 2026 email threat report later said phishing pointing to Tycoon2FA fell 15% in March, driven largely by the disruption, and that the operators had since shifted hosting providers and domain registration patterns in a partial recovery.

  • phishing as a service
  • AiTM phishing
  • MFA bypass
  • Tycoon 2FA
  • Storm-1747
  • session hijacking
  • Microsoft 365
  • takedowns

What the sources report

  • Microsoft said that by mid-2025 Tycoon 2FA accounted for approximately 62% of all phishing attempts it blocked, including more than 30 million emails in a single month.
  • Microsoft linked the service to an estimated 96,000 distinct phishing victims since 2023, including more than 55,000 Microsoft customers; more than 100 Health-ISAC members were successfully phished, and in New York at least two hospitals, six municipal schools and three universities faced attempted or successful compromise.
  • The 330 seized domains, including control panels and fraudulent login pages, were taken under an order from the US District Court for the Southern District of New York, the first time Microsoft acted in coordination with Europol's Cyber Intelligence Extension Programme.
  • BleepingComputer reported the kit was sold through Telegram for $120 for 10 days of access; Microsoft tracks the group behind it as Storm-1747 and warned attackers could keep access after password resets unless active sessions and tokens were explicitly revoked.
  • Microsoft's Q1 2026 email threat report counted approximately 8.3 billion email-based phishing threats in the quarter, said more than 41% of Tycoon2FA domains used a .RU TLD from the last week of March, and said that towards the end of March the group moved away from Cloudflare to host most of its domains on alternative platforms.

What it means for your organisation

Tycoon 2FA shows that MFA which is not phishing-resistant, including one-time codes relayed through a reverse proxy, does not stop a kit that captures the session cookie at sign-in. BleepingComputer reported it sold for $120 for 10 days of access, and Microsoft says it let criminals with limited expertise run these attacks. The takedown cut volume, but Microsoft observed the operators changing hosting and domains within weeks, so the lasting controls sit with defenders: phishing-resistant authentication, session and token protections, and response playbooks that revoke sessions rather than only resetting passwords.

What we check

  • Map which users, administrators and applications still accept phishable factors (SMS, OTP, push) and test whether Conditional Access requires phishing-resistant methods for privileged and high-risk roles.
  • Run a controlled AiTM phishing simulation to confirm whether a captured session cookie can be replayed from another device or network, and whether token protection or compliant-device requirements block it.
  • Review account-compromise runbooks so they revoke sessions and refresh tokens and check for newly registered MFA methods, OAuth consents and inbox rules, rather than only resetting the password.
  • Hunt in email and Entra ID sign-in telemetry for CAPTCHA-gated credential lures and sign-ins from unfamiliar infrastructure, and confirm log retention supports retrospective hunting.

Sources

Services that cover these checks

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works