Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown

CrowdStrike reports that the Tycoon2FA phishing-as-a-service platform continues to operate despite a prior takedown, indicating the service’s operators have adapted to maintain persistent infrastructure and distribution. The platform enables large-scale credential and 2FA/MFA theft via phishing kits and related tooling, representing an ongoing threat to organizations that rely on non-phishing-resistant authentication; CrowdStrike recommends hardened defenses, phishing-resistant MFA, monitoring and blocking of known infrastructure, and user awareness measures.