Email threat landscape: Q2 2026 trends and insights
Microsoft's Q2 2026 report shows phishing declines post-Tycoon2FA disruption, but Teams-based threats rise.
Microsoft's Q2 2026 threat intelligence report indicates a significant decline in phishing activity following the disruption of the Tycoon2FA platform. However, threat actors are increasingly shifting to social engineering tactics on Microsoft Teams, particularly vishing, with malicious call attempts rising sharply. The report also highlights the use of automated and multi-stage attack chains in campaigns, including a large-scale BEC campaign and a complex phishing campaign delivering malware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Defender for Office 365?
Get an email when a new story names Microsoft Defender for Office 365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe disruption of the Tycoon2FA phishing platform demonstrates that law enforcement and industry action can meaningfully reduce specific attack vectors, but threat actors rapidly adapt by moving to new channels such as Microsoft Teams vishing and automated multi-stage attack chains. This shift highlights that users trained to recognize email phishing may remain unprepared for voice-based social engineering delivered through trusted collaboration tools. Business Email Compromise (BEC) and complex malware delivery campaigns continue to mature, making human vigilance and layered technical controls more critical than ever. Organizations that treat security awareness as a one-time exercise rather than a continuous program will remain persistently vulnerable as attacker tactics evolve.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.