The world's largest criminal forum, 'LeakBase,' used by over 142,000 people, was shut down, and 14 countries cooperated to arrest multiple people and seize the domain.
An investigation led by Europol led to the seizure of a database from LeakBase , one of the world's largest online forums used to buy and sell stolen data and cybercrime tools. Additionally, Tycoon 2FA , a platform that offered tools to spoof sign-in pages for Microsoft 365 and other services, was shut down.
Major data leak forum dismantled in global action against cybercrime forum - LeakBase had over 142 000 registered users, now under investigation by law enforcement | Europol
Office of Public Affairs | United States Leads Dismantlement of One of the World's Largest Hacker Forums | United States Department of Justice
https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums
Global phishing-as-a-service platform taken down in coordinated public-private action - Intelligence shared through Europol's Cyber Intelligence Extension Programme leads to operational results | Europol
https://www.europol.europa.eu/media-press/newsroom/news/global-phishing-service-platform-taken-down-in-coordinated-public-private-action
Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale | Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/
Defending the gates: How a global coalition disrupted Tycoon 2FA, a major driver of initial access and large-scale online impersonation - Microsoft On the Issues
https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/
Europol, Microsoft, TrendAI™, and Collaborators Halt Tycoon 2FA Operations | Trend Micro (US)
https://www.trendmicro.com/en_us/research/26/c/tycoon2fa-takedown.html
LeakBase is an online forum with over 142,000 users that trades illegally obtained data from companies and individuals, as well as huge amounts of data such as credit card numbers, debit card numbers, bank account numbers, and usernames and passwords for various services.
Between March 3rd and 4th, 2026, law enforcement agencies from 14 countries, including Europol, launched simultaneous actions against the LeakBase administrators and their users, seizing the website, arresting those involved, and issuing warning messages to users.
At the time of writing, when you access LeakBase, you will see the message 'This website has been seized.'
This Website Has Been Seized
https://leakbase.la/
Additionally, a public-private partnership led to the seizure of Tycoon 2FA, a platform that offered phishing services.
Tycoon 2FA is a service that provides users with tools for phishing scams, allowing them to mimic sign-in pages for services like Microsoft 365, OneDrive, and Gmail, and obtain user login information. The pages were so precisely mimicked that two hospitals, six public schools, and three universities in New York alone were affected.
According to Microsoft, Tycoon 2FA accounted for approximately 62% of all phishing attacks blocked by the company by mid-2025, and at one point blocked more than 30 million emails in a single month. Tycoon 2FA was known as a 'ready-to-use phishing toolkit' and is believed to have been used by thousands of people.
In this case, law enforcement agencies including Europol and private companies such as Microsoft and Trend Micro cooperated in the investigation, and more than 300 domains related to Tycoon 2FA were seized.
Related Posts:
in Security, Posted by log1p_kr