← Back to Feed
Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations
March 4, 2026 · Trend Micro · Severity: MEDIUM
Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) proxying.
Key Takeaways
- Europol, Microsoft, TrendAI, and other industry collaborators dismantled the Tycoon 2FA platform, a phishing-as-a-service operation offering MFA bypass.
- Tycoon 2FA offered MFA bypass services using adversary-in-the-middle proxying to steal credentials and session tokens.
- Organizations should strengthen authentication monitoring and educate users, since phishing kits now routinely bypass MFA via AitM.