Coinbase and Microsoft Destroy Tycoon 2FA Phishing Empire, But Is It Enough?

by

Coinbase, in an unusual alliance with Microsoft, Europol, and a few other not-so-surprising partners, decided to dismantle Tycoon 2FA, a phishing-as-a-service monstrosity that cybercriminals have been using to swipe login credentials and sidestep multi-factor authentication [MFA].

Their joint mission targeted the infrastructure powering Tycoon’s operations, which, let’s be honest, wasn’t exactly state-of-the-art. This included domains hosting the platform’s control panels and phishing pages. Who knew phishing needed so much infrastructure?

Microsoft, in an unexpected legal move, filed a civil action that led to a court-authorized seizure of key domains. In layman’s terms: they broke the internet, and Tycoon was offline, for now.

The effort wasn’t just about lawyers and server shutdowns; they brought in blockchain analysis too, tracking the financial flows that funded the whole phishing fiesta. The complexity of it all
 one would think they were making a heist movie.

Phishing Platform Designed to Bypass MFA – Because That’s What We Need

Tycoon didn’t just stop at being your average phishing scam. No, it was a subscription-based service – your one-stop shop for harvesting credentials, courtesy of expertly cloned login pages mimicking the likes of Microsoft 365 and other oh-so-trustworthy services.

These scam artists didn’t stop at usernames and passwords; they went the extra mile, snatching authentication codes in real-time. And the cherry on top? They snatched session cookies, making MFA feel completely unnecessary. It’s like running a red light and never getting caught by the cameras.

Security experts are now worried, and rightfully so. With this little trick, Tycoon made credential theft a gateway to other dark deeds, like account takeovers, business email compromises, and, of course, invoice fraud. Oh, the joy!

Coinbase Traced Crypto Payments – Like a Financial Detective

Coinbase’s Global Intelligence team, ever the diligent sleuths, tracked down cryptocurrency payments funding Tycoon’s grand operation. This phishing platform wasn’t just a hobby project; it was a full-fledged business, complete with subscription models and recurring revenue streams. No, really, they even had resellers. This was phishing 2.0.

Blockchain analysis helped uncover the financial connections between the platform’s shady operators and the rest of their dodgy network. How quaint. And guess what? They also found out who’s behind this operation. Meet Saad Fridi, believed to be based in Pakistan. He’s probably reading this article somewhere, laughing.

Phishing Attacks Still Reigning Supreme in the Crypto World

This disruption, however, doesn’t solve the bigger picture. The crypto world is still a breeding ground for phishing attacks, and they aren’t going away anytime soon. A recent report showed a rather alarming $112.53 million in losses from crypto-related hacks during January and February 2026. Who’s counting at this point?

Even though the crypto world is full of protocol vulnerabilities, social engineering remains the real villain. And platforms like Tycoon? Well, they’re just contributing to the flood of credential theft campaigns targeting unsuspecting crypto users.

Taking Down the Phishing Economy – One Fishy Platform at a Time

According to Coinbase, dismantling services like Tycoon requires more than just taking down servers; it’s about disrupting the financial networks that make these phishing platforms possible. Maybe the real villain here is a financial ecosystem built to facilitate crime. Who’s surprised?

Coinbase vowed to keep working with tech companies and law enforcement. Apparently, cryptocurrency and cybercrime don’t mix well. Go figure.

Final Summary

  • Coinbase and Microsoft teamed up to shut down Tycoon 2FA, a phishing-as-a-service platform built to steal credentials and bypass MFA protections. A heroic endeavor, if we’ve ever seen one.
  • This disruption came at a time when phishing attacks are still the reigning champion of crypto losses, with millions of dollars gone in the blink of an eye.

Read More

2026-03-04 20:08