security: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
Microsoft Security Blog
2026-03-04
Microsoft reports that the Tycoon2FA adversary-in-the-middle (AiTM) phishing-as-a-service kit supported campaigns targeting over 500,000 organizations per month and describes how it operated at scale. Microsoft’s Digital Crimes Unit, working with Europol and industry partners, disrupted Tycoon2FA’s infrastructure and operations.