Europol Takes Down Tycoon2FA Phishing Empire
International law enforcement dismantles massive phishing-as-a-service platform responsible for tens of millions of monthly attacks.
Europol just pulled the plug on Tycoon2FA, one of the biggest phishing-as-a-service operations on the planet. The international law enforcement takedown targeted a platform that was pumping out tens of millions of phishing messages every single month.
Tycoon2FA operated as a PhaaS — essentially a subscription service for cybercriminals. Instead of building their own phishing infrastructure, attackers could rent access to ready-made tools designed to bypass two-factor authentication. It was cybercrime made turnkey.
The coordinated operation spanned multiple countries, with Europol orchestrating the effort. The sheer scale of the disruption is notable — platforms like Tycoon2FA have become the backbone of modern phishing campaigns, lowering the barrier to entry for would-be attackers.
One major cog in the phishing-as-a-service machine just got wrecked. How long before the next one fills the void?