TYCOON 2FA GOES BOOM AS EUROPOL, VENDORS BUST PHISHING PLATFORM

Summary from the TLDR InfoSec newsletter

Europol and vendors, including Microsoft, Trend Micro, Cloudflare, and Proofpoint, have dismantled the Tycoon 2FA phishing‑as‑a‑service platform, which had powered a majority of Microsoft‑blocked phishing attempts and enabled large‑scale MFA‑bypass Business Email Compromise (BEC) campaigns. Its adversary‑in‑the‑middle token-theft attack highlighted the need to move to phishing‑resistant MFA, such as FIDO2 keys.