Singapore Police Force and INTERPOL Disrupt Tycoon2FA Platform - 2 Pakistani nationals arrested
Two Pakistani nationals arrested by Pakistan Authorities after joint investigation into syndicate linked to more than 96,000 victims worldwide. Tycoon2FA was a Phishing-as-a-Service platform.
SINGAPORE, 3 August 2026, The Singapore Police Force (SPF) has announced the disruption of a foreign cybercrime syndicate known as “Tycoon2FA” following close cooperation with Pakistan’s National Cybercrime Investigation Agency (NCCIA) and INTERPOL.
Background
Two Pakistani nationals, believed to be the developers of the platform, were arrested in Pakistan on 25 June and 1 July 2026.
Officers from the SPF’s Cyber Command shared intelligence and investigative findings with their Pakistani counterparts and INTERPOL after an earlier EUROPOL-supported operation dismantled key infrastructure of Tycoon2FA in March 2026.
Operation Details
Tycoon2FA operated as a phishing-as-a-service platform.
Subscribers paid a monthly fee for ready-made phishing infrastructure that allowed them to create deceptive pages and platforms designed to steal login credentials and bypass security measures.
Globally, the service has been linked to more than 96,000 phishing victims.
In Singapore, at least three cases were reported between November 2025 and January 2026 in which business email accounts were compromised despite the use of multi-factor authentication.
Arrests and Evidence
Acting on intelligence provided by the SPF and international partners, the NCCIA arrested the two suspects under Pakistan’s Prevention of Electronic Crimes Act 2016.
During the operation, one laptop, two central processing units and six mobile devices were seized.
Investigations by the NCCIA remain ongoing.
Response
Senior Assistant Commissioner of Police Justin Wong, Commander of the SPF’s Cyber Command, said: “The SPF will work with our law enforcement partners to identify, track down, and apprehend cybercriminals who target Singapore wherever they are in the world. We thank the NCCIA, EUROPOL and INTERPOL for their invaluable partnership in dismantling this criminal network and making our cyberspace safer for all.”
INTERPOL’s Cybercrime Director Neal Jetton emphasised the importance of cross-border cooperation: “Cybercriminals exploit borders to conceal their identities and evade justice, but international police cooperation ensures they have fewer places to hide. This operation demonstrates how timely intelligence exchange, trusted partnerships and coordinated operational action can connect investigators across jurisdictions to identify and apprehend those responsible for transnational phishing attacks.”
Pakistan’s NCCIA Director General Syed Khurram Ali added: “This case demonstrated the critical role of international cooperation in combating transnational cybercrime. The disruption of platforms such as Tycoon2FA is essential in protecting victims across jurisdictions.”
Impact
The case highlights the growing threat of phishing-as-a-service models, which lower the technical barrier for cybercriminals and enable large-scale attacks that can defeat even multi-factor authentication.
Authorities continue to urge organisations and individuals to remain vigilant against sophisticated phishing attempts.