Phishing Is a Subscription Now

On 4 March 2026, criminals logging into one of the most widely used phishing platforms in the world found a law-enforcement splash screen where their control panel used to be. A coalition coordinated by Europol — police from six countries, plus Microsoft, Cloudflare, Proofpoint, Trend Micro and others — had seized 330 domains at the core of Tycoon 2FA, a service Europol said had touched nearly 100,000 organizations, including schools, hospitals and public institutions.

Within about 48 hours, CrowdStrike's incident responders watched campaign volume climb back to pre-disruption levels, with the same tactics and no material decline in daily cloud account compromises. The takedown was real. So is the lesson: phishing is no longer a skill criminals learn, it is a subscription they buy — and the flagship feature of the product category is getting past your MFA.

A service industry with customer support

Tycoon 2FA appeared in August 2023 and was sold openly on Telegram: $120 for ten days of web-panel access, or $350 for a month. For that price a subscriber got what any SaaS customer expects — hosted infrastructure, a dashboard, templates, updates and support. Trend Micro's research counted roughly 2,000 customers and more than 24,000 domains used by the service since it launched.

The output of that small customer base was industrial. Microsoft, which tracks the operation as Storm-1747, attributed about 62% of all phishing attempts it blocked in mid-2025 to Tycoon 2FA — including more than 30 million malicious emails in a single month — and counted an estimated 96,000 distinct phishing victims since 2023. Intel 471 linked the platform to over 64,000 phishing incidents. One developer, a few thousand subscribers, a measurable share of the entire global phishing problem.

This is the same specialization the malware economy went through — the pattern we traced in our infostealer analysis, and the reason the phishing kit has evolved into full phishing-as-a-service: each layer of the intrusion is now someone's product. The person who emails your employee did not build the fake login page, and the person who built it will never see your network. What the subscriber buys is not a web page; it is the hardest part of the attack, solved.

The feature your MFA rollout didn't account for

The hard part Tycoon 2FA solved is multi-factor authentication. Its pages are not static clones hoping to catch a password; they are adversary-in-the-middle proxies that relay the victim's session to the real identity provider in real time. The victim completes a genuine login — password, one-time code, push approval, all of it works — while the proxy in the path captures the credentials and, crucially, the session cookie issued after MFA succeeds. Replay that cookie and the attacker is inside the account, no second factor required: session hijacking as a packaged product feature.

The engineering around the proxy is aimed at defenders, not victims. CrowdStrike's analysis describes CAPTCHA gates that filter out automated scanners before the fake login renders, geofencing checks, and generative-AI-built decoy pages served to visitors who fail them — so the analyst sees a harmless page where the victim saw a Microsoft 365 login. Compromise is followed by automated logins from the operator's infrastructure, then the familiar business-email-compromise playbook: suspicious inbox rules, concealment folders, internal lures sent from the trusted account.

The victim's MFA worked perfectly. Every factor verified the user to the service. Nothing in the flow verified that the page in the middle was legitimate — and that gap is exactly what the subscription pays for.

That gap is structural, which is why it can be bought at scale. Here is how the common factors fare when the login is proxied:

Number matching and push notifications still matter — they blunt the MFA fatigue attacks that hammer users with prompts. But against a proxy they are bypassed by design, because the user is genuinely authenticating. The only factors that hold are the ones that authenticate the site back: origin-bound credentials that simply do not work on a lookalike domain.

The takedown that didn't take

The March operation followed the September 2025 disruption of RaccoonO365, Tycoon 2FA's main competitor, and it hurt: CrowdStrike measured daily campaign volume dropping to about 25% of pre-disruption levels on 4–5 March. Then it recovered. Domain registration for credential harvesting resumed at its old pace, the TTPs did not change, and some pages kept running on domains active since 2025 that the seizure never touched. Proofpoint had observed over three million Tycoon 2FA messages in February 2026 alone — a flow that 330 seized domains could interrupt but not end, when the service had burned through 24,000.

For a security leader, the planning assumption this forces is uncomfortable but clarifying: law enforcement can raise the attacker's costs, and the coalition behind the takedown deserves credit for doing exactly that — but no pending operation will remove AiTM phishing from your threat model. The capability is commoditized, the price is $350 a month, and when one brand falls its subscribers migrate to the next panel. Your defenses have to work in a world where this service exists, permanently.

A playbook that assumes the click

Everything about PhaaS — the volume, the pixel-perfect proxying, the AI decoys — argues against a defense that depends on every employee spotting every fake. The controls that hold are the ones that stay standing after a good employee makes a reasonable mistake.

1. Move your most-targeted accounts to phishing-resistant MFA first. CISA's guidance is blunt: not all MFA is equally secure, and FIDO2-based authentication is the standard worth migrating to. Start where AiTM attackers start — admins, finance, executives, help desk — and treat the rollout as the program our passkeys migration guide describes, not a someday project.
2. Bind sessions to devices and conditions. Conditional access that requires a compliant or managed device turns a stolen cookie into a dead token. Where your identity provider offers token protection or token binding, enable it; where it does not, alert on sign-ins from datacenter IP ranges and impossible travel.
3. Treat session revocation as part of every reset. A password change does not evict an attacker holding a live session and refresh token. Compromise response must revoke sessions and tokens explicitly — and your incident response plan for social engineering should say so in writing.
4. Watch the after-login tells. New inbox rules, mail forwarding changes, consent grants, and logins from unfamiliar infrastructure within minutes of a successful MFA login are the signature of a replayed session. These detections catch the breach your filters missed.
5. Teach the one check the proxy cannot fake. Every relayed login still happens on the wrong domain. Train the habit of checking the address bar before authenticating, treat a CAPTCHA in front of a login page as a red flag, and tell employees that a password manager refusing to autofill is a stop signal, not a glitch.
6. Simulate the attack you actually face. If your phishing simulations end at the click, you are not rehearsing the part that now matters — the fake login. Credential-entry and AiTM-style scenarios show who would have authenticated, and feeding those results into a human risk score tells you which users and teams need phishing-resistant factors and coaching first.

The subscription economy of phishing is not going away; March 2026 proved that even a six-country takedown only pauses it. What a defender controls is whether a $350 panel still works against their people and their sessions. Make the high-value logins origin-bound, make stolen cookies worthless off the device, and make the fake-login rehearsal part of how you measure human risk — and the product your attackers are paying for stops delivering.