Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown
2026-03-21T07:23:32Z•055c78d912ec6befc0f8e376800f7ae415aeef0876f1bccf59114c8e01a78024
AI-securityCharlotte-AIFalcon AIDRNVIDIA NeMo GuardrailsPatch-TuesdaySIEMTycoon2FAXIoThealthcare-securitymacOS-sensormalwarenational-securitynetwork-visibilitypatchingphishingphishing-as-a-servicesensor-native-loggingstealersupply-chain-compromisetrivy-actionvulnerabilities
What happened
CrowdStrike published a series of blog posts (Mar 6–20, 2026) covering active threats, product updates, and vulnerability guidance: a persistent Tycoon2FA phishing-as-a-service platform surviving a takedown; a trivy-action supply‑chain compromise that evolved from a scanner to a stealer; recommendations to secure homegrown AI agents with Falcon AIDR and NVIDIA NeMo Guardrails; expanded Falcon for XIoT coverage (including healthcare environments); enhancements to the Falcon macOS sensor for improved network visibility; the March 2026 Patch Tuesday analysis (82 CVEs patched, including eight CVEs
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- crowdstrike_blog
- Record identifier
- 055c78d912ec6befc0f8e376800f7ae415aeef0876f1bccf59114c8e01a78024
- Enrichment time
- 2026-03-21T07:23:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.