Daily Briefing for 03.05.26

Top stories.

• Law enforcement disrupts Tycoon 2FA phishing-as-a-service platform.
• FBI and Europol seize Leakbase cybercriminal forum.
• Cisco warns of fresh Catalyst SD-WAN exploits.

Law enforcement disrupts Tycoon 2FA phishing-as-a-service platform.

A Europol-coordinated law enforcement operation shuttered 330 domains used by the popular phishing-as-a-service platform Tycoon 2FA, dismantling the core infrastructure of the criminal service. Microsoft used a court order to seize the domains with support from private-sector partners, while the seizure of infrastructure was carried out by law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom. Tycoon 2FA grew to be one of the largest phishing services in the world after it emerged in 2023, accounting for 62% of all phishing attacks observed by Microsoft in mid-2025.

In addition to law enforcement entities, Microsoft credits Proofpoint, Intel 471, eSentire, SpyCloud, Cloudflare, Health‑ISAC, Resecurity, Trend Micro, Coinbase, and the Shadowserver Foundation for their contributions to the takedown.

FBI and Europol seize Leakbase cybercriminal forum.

A separate law enforcement operation carried out by the US FBI and European law enforcement agencies shut down the Leakbase cybercriminal forum, the Record reports. The US Justice Department stated, "On March 3 and 4, law enforcement agents and officers in 14 countries including the United States took synchronized actions against LeakBase and its users in a coordinated effort hosted by Europol in The Hague. Specifically, the United States and other countries shut down LeakBase, seized its data and two of the domains used by the forum, posted seizure banners on the LeakBase sites, sent prevention messages to LeakBase members, and collected additional evidence. Law enforcement also executed search warrants, arrests, and conducted interviews in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom."

The operation resulted in thirteen arrests. Brett Leatherman, assistant director of the FBI's cyber division, said in an interview, "We expect that these actors who've been arrested will potentially have information or evidence that would help us move upstream against other actors."

Cisco warns of fresh Catalyst SD-WAN exploits.

Cisco warns that threat actors are exploiting two recently patched Catalyst SD-WAN vulnerabilities (CVE-2026-20128 and CVE-2026-20122), SecurityWeek reports. CVE-2026-20128 is a high-severity information disclosure issue that can allow an authenticated, local attacker to obtain Data Collection Agent (DCA) user privileges on a vulnerable system. CVE-2026-20122 is a medium-severity flaw that can enable an authenticated, remote attacker to overwrite arbitrary files on the local file system. SecurityWeek notes that attackers are likely chaining the flaws with other vulnerabilities.

Cisco warned last week that a critical SD-WAN flaw (CVE-2026-20127) was being exploited as a zero-day; it's unclear if the new exploitation is part of the same attack campaign.