{"id":94939,"date":"2026-03-04T21:22:16","date_gmt":"2026-03-04T18:22:16","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=94939"},"modified":"2026-03-04T21:25:15","modified_gmt":"2026-03-04T18:25:15","slug":"microsoft-and-coinbase-aid-in-shutting-down-tycoon-phishing-service","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/microsoft-and-coinbase-aid-in-shutting-down-tycoon-phishing-service\/","title":{"rendered":"Microsoft and Coinbase Aid in Shutting Down Tycoon Phishing Service"},"content":{"rendered":"

Europol, in collaboration with Coinbase, Microsoft, and other tech companies, halted<\/a> the operations of Tycoon 2FA, a service providing phishing software.\u00a0<\/p>\n

\"image\"
“Placeholder” for the Tycoon domain. Source: Europol.\u00a0<\/figcaption><\/figure>\n

Operating since at least August 2023, the service was among the largest distributors of data theft tools. According to law enforcement, Tycoon was responsible for approximately 62% of all phishing attacks blocked by Microsoft.<\/p>\n

The platform’s tools for cybercriminals created convincing clones of original websites and could intercept 2FA<\/span> passwords through access to cookies.<\/p>\n

In collaboration with Europol, fintech firms “provided technical expertise and infrastructure analysis.”<\/p>\n

In a separate press release<\/a>, Coinbase detailed its role in the case. The cryptocurrency exchange tracked the payment channels that financed Tycoon.\u00a0<\/p>\n

\n

“Platforms providing phishing services operate like illegal software sales services: subscriptions, resellers, support, regular income. Some of these payments are made through cryptocurrency, and blockchain transactions create investigative leads that can help link operators, buyers, and the corresponding infrastructure,” company representatives noted.<\/p>\n<\/blockquote>\n

Additionally, Coinbase helped identify the administrator of Tycoon, who is believed to be Saad Fridi from Pakistan. Meanwhile, Microsoft filed a civil lawsuit that led to the confiscation of Tycoon’s key domains.<\/p>\n

Exchange representatives noted that they will continue efforts to hold clients of the illegal platform accountable.\u00a0<\/p>\n

\n

“When criminals cannot receive money and maintain their infrastructure, their ‘business model’ collapses,” Coinbase emphasized.<\/p>\n<\/blockquote>\n

Back in 2025, the amount stolen through phishing attacks decreased<\/a> by 83% to $83.85 million, according to SlowMist data.<\/p>\n","protected":false},"excerpt":{"rendered":"

Europol, in collaboration with Coinbase, Microsoft, and other tech companies, halted the operations of Tycoon 2FA, a service providing phishing software.<\/p>\n","protected":false},"author":1,"featured_media":94940,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Europol, Coinbase, and Microsoft shut down Tycoon 2FA, a major phishing software provider.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[138,44,15],"class_list":["post-94939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-coinbase","tag-cybercrime","tag-microsoft"],"aioseo_notices":[],"amp_enabled":true,"views":"178","promo_type":"1","layout_type":"1","short_excerpt":"Europol, Coinbase, and Microsoft shut down Tycoon 2FA, a major phishing software provider.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=94939"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94939\/revisions"}],"predecessor-version":[{"id":94941,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94939\/revisions\/94941"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/94940"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=94939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=94939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=94939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}