Coinbase, Microsoft, and Europol successfully dismantled Tycoon 2FA, a phishing-as-a-service platform active since August 2023 that bypassed multi-factor authentication using stolen session cookies and tokens. Approximately 2,000 users were involved, and 330 of the roughly 24,000 domains were seized. The platform targeted Microsoft 365, Outlook, and Gmail accounts. Coinbase traced cryptocurrency transactions linked to Tycoon, aiding civil enforcement proceedings against developer Saad Fridi.