Coinbase, Microsoft, and law enforcement disrupted the Tycoon 2FA phishing‑as‑a‑service operation by tracing its payments, identifying its administrator, and coordinating a takedown.