This campaign report details the email threat landscape in Q2 2026, highlighting a large volume of phishing threats detected by Microsoft. The takedown of the Tycoon2FA phishing-as-a-service platform led to a substantial reduction in phishing volume associated with that service. Other phishing techniques such as QR code phishing and CAPTCHA-gated phishing also declined significantly during the quarter. Credential theft remains the dominant attack objective in payload-based phishing. Business email compromise activity returned to baseline levels after an unusual surge in April. Notably, threats leveraging Microsoft Teams increased markedly, with malicious call attempts rising to nearly tenfold the baseline established in mid-2025. Indicators include multiple malicious domains, file hashes, and URLs linked to phishing campaigns.

The threat landscape involves massive volumes of phishing attacks primarily aimed at credential theft, posing risks to user account security and organizational data integrity. The disruption of a major phishing-as-a-service platform significantly reduced related phishing activity, indicating the impact of law enforcement actions. The rise in Microsoft Teams-based threats suggests an evolving attack surface targeting collaboration platforms, potentially increasing risk of social engineering and vishing attacks. Business email compromise remains a concern but has stabilized to historical norms after a temporary spike.

No official patch or fix applies as this is a threat landscape report rather than a software vulnerability. Organizations should remain vigilant against credential phishing and evolving phishing techniques, particularly those targeting Microsoft Teams. Monitoring for indicators of compromise such as the listed malicious domains and hashes can aid detection. The takedown of Tycoon2FA demonstrates the effectiveness of disrupting phishing infrastructure. Continued user education on phishing risks and cautious handling of unexpected communications are recommended.