Coordinated action disrupts the Tycoon 2FA phishing platform

Microsoft, working with Europol and several industry partners, has disrupted the Tycoon 2FA phishing platform and seized or blocked more than 300 domains used by its infrastructure. Tycoon 2FA was sold as a service and supplied ready-made phishing kits imitating login pages for services including Microsoft 365 and Gmail. The platform used adversary-in-the-middle techniques to capture both credentials and authentication tokens in real time, which effectively defeated multi-factor authentication. The operation has been running since at least 2023 and has targeted organisations worldwide.

What this means for your organisation

The significant point is not that one platform is gone, but that the defence many Norwegian organisations rely on does not hold. Multi-factor authentication based on one-time codes or push approvals does not stop an attacker who steals the session itself. When an account with access to email, file sharing and finance systems is taken over this way, the sign-in looks legitimate in the logs, and the compromise can continue for a long time before anyone reacts. The practical exposure is invoice fraud, data theft and onward spread to customers and suppliers.

Berigo recommends

• Move to phishing-resistant authentication using FIDO2 keys or passkeys for administrators, the leadership team and everyone with access to payments.
• Enable conditional access that binds the session to a known device and location, so a stolen token cannot be replayed from an arbitrary machine.
• Monitor and alert on unusual sign-ins, new mail forwarding rules and OAuth consents granted to unknown applications.
• Rehearse account takeover as a scenario in your incident response plan, including how you revoke active sessions quickly.

Source

• blogs.microsoft.com
• europol.europa.eu