Inside Tycoon 2FA: Disrupting A Global Phishing Operation
Resecurity, Friday, March 6th, 2026
Resecurity is proud to contribute to disrupting of Tycoon 2FA, a cybercriminal platform that generated more than 30 million bogus emails in a single month. The joint effort, led by Microsoft, Europol, and other industry partners, aimed to target its infrastructure responsible for tens of millions of fraudulent emails reaching over 500,000 organizations each month worldwide.
By mid‑2025, Tycoon 2FA accounted for approximately 62 percent of all phishing attempts Microsoft blocked, including more than 30 million emails in a single month. That placed Tycoon 2FA among the largest phishing operations globally. Despite extensive defenses, the service is linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers.
Taking this infrastructure offline cuts off a major pipeline for account takeovers and helps protect people and organizations from follow‑on attacks such as data theft, ransomware, business email compromise, and financial fraud.