Europol, Coinbase, and Microsoft have shut down the Tycoon phishing service, a major player in online fraud.
Europol, alongside Coinbase, Microsoft, and other technology firms, has successfully dismantled the Tycoon 2FA service, known for its phishing software.
Launched in August 2023, Tycoon rapidly became a prominent distributor of data theft tools, responsible for around 62% of phishing attacks that Microsoft managed to block.
The service enabled cybercriminals to replicate legitimate websites convincingly and capture two-factor authentication passwords by exploiting cookies.
In its partnership with Europol, fintech companies provided essential technical insights and infrastructure assessments.
Coinbase outlined its involvement in a press release, highlighting its efforts to monitor payment channels that financially supported Tycoon.
"Phishing service platforms operate similarly to illegal software sales: they offer subscriptions, reseller programs, and ongoing support. Many of these transactions utilize cryptocurrency, and blockchain trails can lead to investigations that connect operators with their buyers and infrastructure," stated Coinbase representatives.
Additionally, Coinbase played a crucial role in identifying Tycoon’s administrator, believed to be Saad Friedi from Pakistan. Microsoft furthered the efforts by filing a civil lawsuit that resulted in the seizure of key domains associated with Tycoon.
Coinbase reiterated its commitment to holding the clients of this illicit platform accountable.
"When criminals are unable to receive funds and sustain their operations, their business model fails," Coinbase emphasized.
According to SlowMist, the total amount stolen through phishing schemes saw a significant decline of 83% to $83.85 million in 2025.
October 28, 2026
October 28, 2026
October 28, 2026
October 28, 2026