Coinbase and Microsoft Dismantle Tycoon 2FA Phishing Network

In a coordinated international effort, Coinbase, Microsoft, and Europol have successfully neutralized Tycoon 2FA, a prominent Phishing-as-a-Service (PhaaS) platform. The operation resulted in the seizure of 330 malicious domains used to facilitate large-scale cyberattacks. Since its inception in August 2023, the platform has been a central hub for bypassing security protocols, targeting over 500,000 businesses globally through sophisticated credential theft and session hijacking.

Scope of the Tycoon 2FA Cyber Operations

The Tycoon 2FA platform operated on a massive scale, providing tools to approximately 2,000 active users who managed a network of over 24,000 domains. The infrastructure was capable of dispatching tens of millions of fraudulent emails every month. Unlike traditional phishing, this service specialized in bypassing Multi-Factor Authentication (MFA) by intercepting session cookies and security tokens.

• Targeted services included Microsoft 365, Outlook, and Gmail.
• The platform primarily focused on compromising corporate email and online service accounts.
• The primary developer has been identified by authorities as Saad Fridi, a Pakistani national.

The Role of Cryptocurrency in the Investigation

Coinbase played a pivotal role in the takedown by leveraging its blockchain analytics capabilities to track cryptocurrency payments used to fund the platform's operations. By tracing the flow of digital assets, investigators were able to link the illicit infrastructure to its administrators. Furthermore, Coinbase supported the civil lawsuit that enabled the legal seizure of the domains, demonstrating the increasing collaboration between blockchain service providers and global law enforcement to combat cybercrime.

Phishing-as-a-Service models allow low-skill attackers to rent sophisticated tools, significantly lowering the barrier to entry for high-level cyber espionage and financial theft.

The dismantling of Tycoon 2FA marks a significant victory for global cybersecurity, highlighting the effectiveness of public-private partnerships. By integrating blockchain forensics with traditional law enforcement techniques, the coalition has disrupted a major source of corporate data breaches. The investigation continues as authorities work to mitigate the impact of the stolen data and prevent the resurgence of similar PhaaS infrastructures in the digital asset ecosystem.