Joint Operation Takes Down Tycoon 2FA Phishing Network

A major breakthrough in the fight against cybercrime has been achieved with the dismantling of Tycoon 2FA phishing network. The platform, which was active since at least 2023, allowed hackers to intercept live authentication sessions and access online accounts without triggering multi-factor authentication prompts.

According to Europol, Tycoon 2FA sold a subscription-based toolkit that enabled cybercriminals to capture session cookies from authenticated users. This toolkit was used by bad actors to gain unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions.

Coinbase played a crucial role in tracing blockchain transactions linked to the Tycoon 2FA phishing network, which led to the identification of the platform's alleged administrator and several users of the service. The company stated that it will continue to support law enforcement efforts to identify those who purchased and used the service.