Crypto: Coinbase, Microsoft And Europol Take Down Phishing Service ‘tycoon...
Tycoon 2FA accounted for 62% of phishing attempts Microsoft blocked by mid last year, including over 30 million emails in a single month.
A coalition of tech companies and law enforcement, including Coinbase, has dismantled the core infrastructure of Tycoon 2FA, a major phishing-as-a-service platform that offered tools to bypass multi-factor authentication.
Europol announced Wednesday that Microsoft helped block 330 domains linked to the platform, while law enforcement seized additional key infrastructure.
Financial tracing was also a key aspect. Coinbase said it assisted by tracing blockchain-related transactions funding Tycoon 2FA, which helped identify the phishing platform's alleged administrator and buyers.
“Taking Tycoon’s core infrastructure offline cuts off a major pipeline for credential theft and initial access, and forces criminals to rebuild, retool, and take on more risk,” Coinbase added.
Phishing scams were flagged as the second-largest threat in 2025 by blockchain security firm Certik, costing crypto investors $722 million across 248 incidents. A PeckShield spokesperson told Cointelegraph on Monday that phishing remains a “persistent threat” in 2026.
Generally, when a user logs in using MFA, the system generates a session token. The token acts as proof of authentication and is stored in the user’s browser. If a hacker steals the token, they can use it to fool the system and bypass MFA.
“That combination, high-fidelity lures plus session-token theft, turns phishing into a reliable on-ramp for bigger crimes like account takeovers, business email compromise, invoice fraud, and follow-on social engineering,” Coinbase added.
Tycoon has been active since at least 2023, according to Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit. By mid-2025, Tycoon accounted for 62% of phishing attempts Microsoft blocked, including over 30 million emails in a single month.
Related: Traveling? ‘Evil Twin’ WiFi networks can steal crypto passwords
Source: CoinTelegraph
