Coinbase, Microsoft, and Europol team up to shut down the phishing platform Tycoon 2FA, seizing 330 domains

According to market news, Coinbase, in collaboration with Microsoft, Europol, and more than ten other organizations, successfully shut down the phishing-as-a-service platform Tycoon 2FA and seized 330 related domains.

Since its launch in August 2023, Tycoon has had approximately 2,000 users, operating over 24,000 domains, and sending tens of millions of fraudulent emails each month to over 500,000 businesses worldwide. It bypassed multi-factor authentication by stealing session cookies and tokens, primarily targeting email and online service accounts such as Microsoft 365, Outlook, and Gmail.

In this operation, Coinbase assisted in tracking the cryptocurrency payments funding Tycoon’s operations and supported the civil lawsuit to seize the domains. The main developer has been identified as Saad Fridi, a Pakistani national.