What was Tycoon 2FA and how did it bypass two-factor authentication?

Tycoon 2FA was a phishing as a service kit that cloned login pages and proxied traffic to real sites. When users entered credentials and one-time codes, the kit captured both plus the session cookie. With the session token, attackers could access accounts without needing another code. This technique defeats SMS and app-based codes, which are phishable, but is blocked by phishing-resistant MFA like hardware security keys.

How does this Europol cyber operation affect Australian businesses right now?

In the short term, some Tycoon 2FA phishing emails and domains will not resolve, which reduces immediate exposure. However, attackers can spin up new domains or switch to rival kits. Australian firms should treat this as a window to harden controls, move high-risk users to phishing-resistant MFA, tighten domain protections, and rehearse incident response so payment redirection and account-takeover losses decline.

What specific controls should boards prioritise after this takedown?

Prioritise phishing-resistant MFA for executives, finance, HR, and administrators. Enforce conditional access by device health and geography, shorten session lifetimes, and disable legacy protocols. Deploy strict link and attachment scanning, set DMARC to reject with aligned SPF and DKIM, and monitor lookalike domains. Exercise incident response for account takeover, pre-approve takedown requests, and keep ACSC contact and evidence collection playbooks updated.

Law and Government

Europol Disrupts ‘Tycoon 2FA’; 120 Polish Phishing Domains Blocked — March 6

ByDanny Kontos March 6, 2026

Europol’s March 6 disruption of Tycoon 2FA phishing blocked 330 domains across Europe, including 120 in Poland, tied to campaigns that targeted nearly 100,000 organisations. The Europol cyber operation hit a phishing as a service model that bypassed common two-factor methods. For Australia, this may trim near-term scam traffic, yet business email compromise risk remains high. We explain what was taken down, how CERT Polska NASK contributed, and what investors and boards in Australia should prioritise next.