Microsoft, Europol, and several security firms have teamed up to disrupt the Tycoon 2FA phishing-as-a-service (PhaaS) platform.

First spotted in August 2023, Tycoon 2FA uses adversary-in-the-middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

It proxies the real Microsoft 365 or Google login page, and when the victim enters their credentials and MFA code, passes them to the legitimate service in real-time.

And once the service says "Identity Confirmed", it sends back a session token – which is grabbed by Tycoon 2FA before it ever reaches the victim's browser, and incorporated into the attacker's own browser. Since the session is already "authenticated," the platform never asks the user for a code.

Thanks to its complete PhaaS ecosystem, Tycoon 2FA lowered the barriers to entry for cyber criminals. It offered convincing phishing templates, realistic landing pages, and real‑time capture of credentials and authentication codes, all incorporated into an easy‑to‑use package that scaled quickly. Phishing kits started at just $120 for 10 days' access and $350 for a month.

Campaigns frequently extended beyond simple account access into Business Email Compromise (BEC) attacks. By leveraging hijacked session tokens, attackers were able to embed themselves within corporate email environments to monitor internal communications and financial workflows.

From here, they could send legitimate-looking invoices from the compromised account to a third-party partner or vendor.

"Because the fraudulent request originated from a trusted, authenticated account, this multi-stage fraud model bypassed traditional email security filters," Cloudflare wrote in a blog post.

"This allowed attackers to successfully divert payments to criminal-controlled mule accounts, resulting in significant financial losses."

The group has been responsible for tens of millions of phishing messages reaching over 500,000 organizations each month worldwide. It's been linked to more than 96,000 distinct phishing victims globally, including more than 55,000 Microsoft customers and around 5,350 distinct phishing victims in the UK.

It's hit sectors including education, healthcare, finance, non-profit, and government. By the middle of last year, Tycoon 2FA accounted for around 62% of all phishing attempts blocked by Microsoft.

Now, though, in action coordinated by Europol's European Cybercrime Centre (EC3), Microsoft has seized 330 domains forming the core infrastructure of the criminal service, including phishing pages and control panels.

"Disrupting Tycoon 2FA spanned multiple jurisdictions, underscoring why sustained, coordinated pressure is essential, especially as cybercrime becomes more scalable through automation and AI," said Steven Masada, assistant general counsel in Microsoft's Digital Crimes Unit.

However, warned Trend Micro, taking down the platform is by no means the end of the job.

"Operators have always been known to adapt, rebuild, and migrate to new infrastructure," said the firm in its blog. "Known and suspected users of Tycoon 2FA can attempt to continue operations, and previously stolen credentials and session cookies remain in circulation."

The participants in the takedown operation said they plan to monitor for signs of the service resurfacing, and investigate the users and administrators they've been able to identify so far.

GitHub has announced the arrival of its passkeys public beta for passwordless authentication, which the company says will enable seamless and secure access on GitHub.com.

The move will allow users to upgrade their security keys to passkeys to be used in place of both passwords and two-factor authentication (2FA) to bolster overall account security.

In an announcement, the firm explained that most security breaches involve lower-cost attacks such as social engineering, credential theft, or leakage. 

According to data from the FIDO Alliance, the team behind the global authentication standard based on public key cryptography, passwords are estimated to be the root cause of over 80% of data breaches globally.

To tackle this, GitHub said its new passkeys bring easier configuration and enhanced recoverability, providing a secure and private way to protect accounts and minimize the risk of lockouts.

“GitHub is committed to helping all developers employ strong account security while staying true to our promise of not compromising their user experience,” said Hirsch Singhal, staff product manager at GitHub. “We began this commitment with our 2FA initiative across GitHub. 

“Today, we are furthering this work by ensuring seamless and secure access on GitHub.com with the public beta of passkey authentication.”

Users can implement passkeys via the ‘Feature Preview’ tab in the settings sidebar, which now displays an option to ‘enable passkeys’. This will enable the option to upgrade eligible security keys to passkeys, as well as register new passkeys.

How GitHub passkeys work

The new passkeys essentially count as two security layers in one, combining a user element such as a thumbprint, face, or knowledge of a PIN, with a physical element such as a security key or device.

Due to expanded browser support, GitHub said a browser’s autofill system can automatically suggest that users use their passkey to sign in straight from the login page – regardless of whether a user has 2FA enabled.

Passkeys can also be used across more than just the device they were created on, thanks to a new experience labeled ‘Cross-Device Authentication’. 

This allows the use of a passkey on a phone to sign into a laptop, for example, by verifying the phone’s presence.

“Because your phone or tablet must be physically close to your laptop or desktop, Cross-Device Authentication retains the phishing-resistant promise of FIDO,” Singhal said.

Additionally, many passkeys can be synced across multiple devices to help prevent account lock-out due to key loss. This can be done automatically, depending on passkey provider, GitHub said. 

How to upgrade

Existing user security keys that are capable of verifying identity – such as Touch ID, Windows Hello, Android thumbprints, or PIN-locked or biometric hardware keys – are eligible to be upgraded.

Upon next sign in with the security key, GitHub will ask users if they would like to upgrade to a passkey. This will then re-register the security key with the user’s passkey provider to ensure it is discoverable during authentication and synced. Up-to-date devices support passkeys straight out of the box.

“Because passkeys are privacy-preserving, you might have to trigger your passkey a few times during that upgrade flow so we can make sure we’re upgrading the right credential,” Singhal said. “Once you do, you’re all set for a passwordless experience.

“By registering durable, secure credentials across all your devices, we hope to prevent account lockouts due to device loss,” Singhal added. 

Cybercrime is arguably the biggest threat affecting modern businesses. Half of British companies have experienced a cybersecurity incident over the past year, with large (74%) and medium (70%) firms being the most affected.

That’s according to the 2024 Cyber Security Breaches Survey from the UK Government, which also found that phishing attacks, email and online impersonation, and malware are the biggest cybersecurity threats faced by UK firms.

Two-factor authentication (2FA) adds an extra barrier of entry for any third party attempting to access your account.

Requiring users to complete a second round of authentication after entering a password, whether by entering a code sent via text message or email or by using an authenticator app, adds a far more robust protective layer. While it may seem arduous to jump through these hoops, the benefits of having them in place are untold.

What is the difference between 2FA and MFA?

Two-factor authentication (2FA) is a form of multi-factor authentication (MFA) designed to add an additional layer of security to online accounts, services, and apps. It requires users to prove their identity using two forms of authentication, the first of which is a combination of a username and a password.

Passwords are often stolen by hackers and 2FA aims to solve this by forcing anyone attempting to access an online account or service to confirm their identity via a second form of authentication.

Common examples include one-time passwords, push notifications, biometrics, physical security keys, or codes generated by authentication apps. The premise is that only users will know or have access to this information, preventing unauthorized parties from accessing their accounts using breaches or leaked passwords.

Although 2FA falls under the MFA umbrella, it wouldn’t be accurate to use the former to describe the latter. The main difference between the two is that while 2FA only uses two forms of authentication, MFA relies on two or more methods for verifying user identities.

For instance, a user with MFA set up on their account could be asked to first complete a one-time password request after logging in with their username and password, then an additional form of authentication like a fingerprint. Only after passing these stages would they be able to access their account.

How does two-factor authentication work?

Two-factor authentication invariably uses a second, independent device that functions as a buffer between the service and the login attempt.

Some services will supply their own keys, although this has become less common as companies have turned to developing their own smartphone apps or making use of SMS messages. Regardless of whether it's a number-generating key or a confirmation message, the idea is that only the owner of the device will have access to the key and the ability to authorize the login attempt.

The additional security check normally appears after the user has submitted their username and password. Once the system checks that the account exists, it will then ask the user to perform an additional action.

Two-factor authentication has become ubiquitous with most online services that involve sensitive data, whether it’s banking or financial services, e-commerce, or business applications – although many other companies are starting to offer 2FA to stand out from the competition.

How that additional layer appears can vary from service to service. For example, most banks now have their own security tokens for online banking, often in the form of random number generators and usually offered through a smartphone application, although some users may still be using a physical fob. Many online services have now forced users to set up 2FA as a minimum, including Google and Meta though the latter only has this requirement for 'high risk' accounts.

Getting through a second layer of security can be the slowest part of signing into a service but it's an effective way of sifting out those trying to brute force their way into an account.

What are the benefits of 2FA?

The biggest benefit of 2FA is preventing cyber criminals from breaching online accounts using passwords they've stolen or found in leaked databases on the dark web. But there are other reasons why you should use this security feature.

2FA can help tackle password fatigue, the feelings of tiredness associated with having to constantly remember and enter myriad passwords. It means you can choose an easy-to-remember password with the peace of mind that your account will be secured by a second authentication method.

Security leaders have less cause to worry about account breaches if they have a good 2FA policy in place, in the knowledge that cybercriminals have that extra barrier to entry. Adopting features like 2FA is also key to developing a security-first mindset — paramount as the threat landscape worsens.

Remote workers are still difficult for security teams to support, as their devices and corporate access need to be properly configured with 2FA or MFA, but this step is essential for protecting critical corporate accounts while supporting a hybrid work model. This is particularly critical for offices that take a bring your own device (BYOD) approach, as home devices can be more vulnerable to password-stealing malware and therefore need the extra line of defense.

Using 2FA methods like passkeys and authenticator apps provides users with “better and more secure protection”, says ESET global cybersecurity advisor Jake Moore.

“When threats are multi-layered themselves, accounts need the strongest multi-layered protection to stay secure,” he tells ITPro.

But as well as protecting against password breaches, 2FA could also bring about a passwordless future. Moore says this is possible thanks to “superior security options” that offer greater pxrotection against phishing and brute-force attacks than single passwords. He adds: “Passkeys, for example, offer ease of use, security as well as convenience and are already being rolled out smoothly across multiple accounts.”

Is two-factor authentication safe?

Despite the benefits it offers, it's worth noting that multi-factor authentication is not 100% secure. Microsoft has warned businesses against using systems that rely on voice and SMS due to security concerns, warning that these methods use no encryption and are therefore ripe for interception by hackers. With private details to hand, hackers can launch social engineering campaigns

For example, authentication via text message is vulnerable to interception and spoofing by hackers, particularly if they can hijack an account that supports a person's mobile number. Various account recovery processes for lost passwords can also be harnessed by hackers to work around two-factor authentication.

Sophisticated malware that has infected computers and mobile devices can redirect authentication messages and prompts to a device belonging to a hacker, rather than the legitimate account holder, thereby working within but also around two-factor authentication.

The most secure methods of 2FA use dedicated hardware tokens, such as a Google Titan Security Key or YubiKey, which are difficult for hackers to spoof unless they physically steal one. Google's offering, for example, uses cryptography to verify a user's identity and a separate URL to stop would-be attackers from accessing accounts even if they have the username and password.

Methods of 2FA reliant on codes sent via SMS are best avoided if you are running an enterprise with a treasure trove of data. This is because SMS is vulnerable to SIM swap attacks, in which attackers transfer a victim's number to a SIM card in their possession to intercept their messages. If they pull this off on a user they know uses SMS-based 2FA, they could gain access to their account without any alarms going off.

While 2FA may not be quite the security silver bullet it was once expected to be, it's still an important area of security and access control to keep in mind when procuring and setting up services for your business or personal life, because the more hurdles you can put in the hackers' way, the less likely they are to target you.