Phishing-as-a-service (PhaaS): the rental kits that bypass two-factor authentication

By Kike Gandia · Co-Founder & CEO, OSCP · Last updated: November 2026

Phishing-as-a-service (PhaaS) is the model criminals use to rent out ready-made phishing kits: fake pages, infrastructure, control panels and support, in exchange for a subscription. You no longer need to know how to code to launch a campaign capable of bypassing two-factor authentication. This guide explains how they work, what happened to Tycoon 2FA, the kit an international operation with Spanish participation set out to dismantle in 2026, and how to protect yourself. Beware the confusion of terms: PhaaS has nothing to do with a phishing simulation service for training staff.

What phishing-as-a-service is

Just as there is software-as-a-service, there is phishing-as-a-service: one group develops and maintains the kit, and other criminals rent it. The customer gets templates that imitate the login pages of Microsoft 365, Google or banks, ready-made domains, a panel to view stolen credentials and, often, techniques to evade email filters.

The effect is that campaigns that used to require a skilled attacker can now be launched by anyone with money. That is why the volume of sophisticated phishing keeps growing.

How it bypasses two-factor authentication: the proxy in the middle

The most dangerous kits work as an intermediary between the victim and the real page. The victim lands on a fake page that, behind the scenes, relays every piece of data to the genuine Microsoft or Google page in real time:

1. The victim types their username and password into the fake page, which passes them to the real one.
2. The real page asks for the two-factor code; the fake one shows the prompt to the victim and relays what they type.
3. The login completes and the kit keeps the already authenticated session.

With that session, the attacker gets into the account without needing the password or a new code. Microsoft describes Tycoon 2FA in these terms: it captured credentials and session tokens, and it was designed to defeat protections such as multifactor authentication.

Tycoon 2FA: the kit taken down in 2026

In March 2026, Microsoft, Europol and several security companies acted against Tycoon 2FA, one of the most widely used PhaaS kits. According to Microsoft's official blog:

330 active domains were seized, including control panels and fake login pages, under an order from a federal court in New York.
Law enforcement from Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom took part.
It is linked to an estimated 96,000 victims worldwide since 2023, more than 55,000 of them Microsoft customers.
By mid-2025 it accounted for around 62% of the phishing attempts Microsoft blocked.

What happened next

Taking down one kit does not end the model. According to Barracuda data published by SecurityWeek in April 2026, after the operation other kits such as Mamba 2FA, EvilProxy and Sneaky 2FA took its place, and Tycoon fell behind Mamba and EvilProxy in detections. The business goes on: the brands change, not the technique.

How to defend yourself

Phishing-resistant MFA: CISA notes that the only widely available phishing-resistant authentication is FIDO/WebAuthn (security keys and passkeys), because it blocks logins on a fake website. Where that is not yet possible, it recommends at least number matching in authenticator apps.
Session controls: conditional access, shorter sessions and review of logins from unusual locations or devices.
Review your Microsoft 365 configuration: many of these attacks end with forwarding rules or applications with granted permissions; an audit finds them.
Train the workforce: the last barrier is the employee checking the page address before typing the password, and that is learned by practising with simulations, not with one talk a year.

What you can do this week

Check which accounts still use SMS or phone calls as the second factor and prioritise leadership, finance and administrators to move them to keys or passkeys. Review forwarding rules and applications with granted consent in Microsoft 365. And make sure the whole workforce, including new hires, receives simulation campaigns with fake login pages, so they recognize the trick when it arrives for real.

FAQ

Is phishing-as-a-service the same as a phishing simulator?

No. Phishing-as-a-service is a criminal model: phishing kits rented out to attack. A phishing simulator is the opposite: a tool for staff to practise with harmless fake emails and learn to recognize them.

If I have two-factor authentication, am I protected?

Against these kits, not entirely. SMS, call or app codes can be relayed through the fake page. CISA recommends FIDO/WebAuthn (security keys or passkeys), which blocks logins on a website that is not the legitimate one.

Does it affect companies that use Microsoft 365?

Yes. Tycoon 2FA mostly imitated Microsoft login pages, and more than 55,000 of its victims were Microsoft customers, according to the company itself.

What should I do if an employee entered their password on such a page?

Changing the password is not enough: you have to revoke open sessions, review forwarding rules and applications with permissions in their mailbox, and check recent logins. We cover it in detail in the guide on what to do if an employee falls for phishing.

Cybersecurity in short form

Two-factor authentication won't save you from phishing

Sources

Train my workforce against phishing