LinkedIn Carousel - #CyberWeekly Week 13

Belgium vs. Phishing

Europol and a Belgian hacker went after phishers from opposite directions this week — and both won

Tycoon 2FA Taken Down: The Phishing Kit That Beat Your MFA

New: Guided Compliance — From Assessment to Audit-Ready

Belgian Hacker Infiltrates Phishing Gang, Kills 7 Campaigns

Easy Cyber Protection

1/3

Europol and Microsoft kill Tycoon 2FA — the phishing platform that bypassed your MFA

On March 16, Europol and Microsoft announced the dismantling of Tycoon 2FA — one of the world's largest phishing-as-a-service platforms, with one particularly…

How it bypasses MFA: rather than sending you to a fake login page, Tycoon 2FA acts as a real-time proxy between you and the legitimate site. You complete your MFA challenge normally — and hand your live session token straight to the attacker. Your 2FA code is captured as you type it. This is why MFA alone is not a complete defence
Scale of the operation: active since at least 2023, the platform ran 96,000 attacks globally — more than 55,000 against Microsoft 365 customers. Targets included hospitals, research institutions, and government bodies across Europe. Microsoft seized 330 domains that formed its core infrastructure
Belgian footprint: the Federal Computer Crime Unit collaborated in the Belgian leg. Arrests were made in Egypt and Nigeria; the developer was identified in Pakistan. This was the first time Europol coordinated directly with Microsoft on a takedown of this kind

The Brussels Times: full report → https://www.brusselstimes.com/belgium/2025988/huge-online-phishing-platform-dismantled-claiming-500-victims-in-belgium

2/3

Platform Spotlight: Calm Compliance — your full NIS2 journey, one step at a time

This week we shipped the biggest UX change in Easy Cyber Protection's history: Calm Compliance — a guided journey that takes you from your first question all…

Start with an assessment: answer five questions about your organisation (sector, size, existing measures) and ECP calculates your required CyFun compliance level automatically. No consultant needed, no guesswork
An ordered compliance program: instead of a flat list of controls, you now get a structured document library — Step 1: Scope Document, Step 2: Security Policy, Step 3: Risk Assessment, and so on. Each step shows live status and has a procedure template ready to fill
Policy Wizard with AI drafts: click "Draft Policy" on any document, answer a few questions about your situation, and ECP writes a tailored policy draft in seconds. AI runs on Cloudflare — your data stays in Belgium

Get started → https://easycyberprotection.com/contact/

3/3

Belgian ethical hacker infiltrates live phishing gang, kills 7 campaigns targeting Belgian banks

In early March, Belgian ethical hacker Inti De Ceukelaire received a phishing text impersonating Argenta bank — and instead of deleting it, he decided to…

How he got in: after entering fake card details on the phishing site, De Ceukelaire inspected the page source and found a URL pointing to the admin panel. Phishing panels often trust requests from 127.0.0.1 (localhost) because the attacker tested it on their own machine — so he spoofed that IP using Burp Suite and walked straight in, no password needed
What he saw: a live real-time dashboard where the attacker could watch victims type their details and prompt them for additional authentication tokens step by step — like a remote-controlled scam. Logos present for Argenta, Belfius, KBC, ING, CBC and several other European banks
How he killed the campaigns: he deleted the Telegram bot integration to silence attacker alerts, took over a WordPress installation on the same server, downloaded a backup containing the attackers' IP addresses and Telegram metadata, then modified the panel's code to block all non-Moroccan IPs and display a victim warning instead

Inti De Ceukelaire: full investigation → https://inti.io/p/how-i-infiltrated-phishing-panels