Coinbase and Microsoft, with Europol, seize 330 domains and shut down Tycoon 2FA phishing service

Coinbase, Microsoft, Europol and ten partners dismantled Tycoon 2FA, a phishing‑as‑a‑service platform that bypassed multi-factor authentication by harvesting session cookies and tokens. Tycoon, active since August 2023, operated more than 24,000 domains and served up to 2,000 users, distributing tens of millions of fraudulent emails that reached over 500,000 organizations monthly and enabling thousands of threat actors to steal credentials at scale. Under a U.S. court order, Microsoft seized 330 active domains and identified the primary developer as Saad Fridi in Pakistan. Coinbase traced the cryptocurrency payments that funded Tycoon and supported civil action to seize domains; law enforcement investigations into buyers and users continue. The takedown follows industry reports (Chainalysis, Scam Sniffer) that phishing‑as‑a‑service has industrialized crypto scams — Scam Sniffer estimates $83.85 million in crypto phishing losses last year, down from $494 million in 2024. Key implications: large‑scale MFA bypass tools materially increase credential and fund theft risk; exchanges and cybersecurity firms are collaborating more closely to trace crypto funding and assist seizures.