{"id":220029,"date":"2026-03-04T17:34:00","date_gmt":"2026-03-04T22:34:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/03\/04\/global-coalition-dismantles-tycoon-2fa-phishing-kit\/"},"modified":"2026-03-04T23:40:12","modified_gmt":"2026-03-05T04:40:12","slug":"global-coalition-dismantles-tycoon-2fa-phishing-kit","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/03\/04\/global-coalition-dismantles-tycoon-2fa-phishing-kit\/","title":{"rendered":"Global coalition dismantles Tycoon 2FA phishing kit"},"content":{"rendered":"<p><a href=\"https:\/\/cyberscoop.com\/tycoon-2fa-phishing-kit-takedown-microsoft\/\">Global coalition dismantles Tycoon 2FA phishing kit<\/a><\/p>\n<p><a href=\"https:\/\/cyberscoop.com\/tycoon-2fa-phishing-kit-takedown-microsoft\/\">https:\/\/cyberscoop.com\/tycoon-2fa-phishing-kit-takedown-microsoft\/<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-03-04 17:34:00<\/a><\/p>\n<p>Source Domain: <a href=\"cyberscoop.com\">cyberscoop.com<\/a><\/p>\n<p>Tycoon 2FA, a major phishing kit and platform that allowed low-skilled cybercriminals to bypass multifactor authentication and conduct large-scale adversary-in-the-middle attacks, was dismantled Wednesday by a global coalition of security companies and law enforcement agencies.<\/p>\n<p>Microsoft, which led the effort alongside Europol and authorities from six countries and 11 security firms or organizations, said it seized 330 domains that powered Tycoon 2FA\u2019s core infrastructure, including control panels and fraudulent login pages.<\/p>\n<p>The platform, which emerged in August 2023, was responsible for tens of millions of phishing messages that reached more than 500,000 organizations globally each month, according to Microsoft Threat Intelligence. Thousands of cybercriminals used Tycoon 2FA to break into email and online services, including Microsoft 365, Outlook, SharePoint, OneDrive and Google services.<\/p>\n<p>\u201cBy mid\u20112025, Tycoon 2FA accounted for approximately 62% of all phishing attempts Microsoft blocked, including more than 30 million emails in a single month. That placed Tycoon 2FA among the largest phishing operations globally,\u201d Steven Masada, assistant general counsel at Microsoft\u2019s Digital Crimes Unit, said in a blog post about the takedown.\u00a0<\/p>\n<p>\u201cDespite extensive defenses, the service is linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers,\u201d Masada added.\u00a0<\/p>\n<p>The phishing kit, which was developed and advertised by a group Microsoft tracks as Storm-1747, was sold to cybercriminals on Telegram and Signal for $350 a month. The platform provided core components for phishing on a single dashboard that allowed cybercriminals to configure, track and refine their campaigns.<\/p>\n<p>The platform also provided cybercriminals with pre-built templates, attachment files for common phishing lures, domain and hosting configuration and redirect logic, Microsoft said. The monthly volume&#8230;<\/p>\n<p><a href=\"https:\/\/cyberscoop.com\/tycoon-2fa-phishing-kit-takedown-microsoft\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Global coalition dismantles Tycoon 2FA phishing kit https:\/\/cyberscoop.com\/tycoon-2fa-phishing-kit-takedown-microsoft\/ Publish Date: 2026-03-04 17:34:00 Source Domain: cyberscoop.com&#8230;<\/p>\n","protected":false},"author":1,"featured_media":220030,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2026\/03\/tycoon2fa-seizure-notice.png","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[25],"class_list":["post-220029","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-phishing"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/220029"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=220029"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/220029\/revisions"}],"predecessor-version":[{"id":220031,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/220029\/revisions\/220031"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/220030"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=220029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=220029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=220029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}