Loading story…
Microsoft reported detecting 7.6 billion email-based phishing threats in Q2 2026, with credential theft driving 94% to 96% of malicious payload activity. The company said its March disruption of the Tycoon2FA phishing-as-a-service platform cut message volume tied to that operation by 92% from pre-disruption levels, while QR-code phishing and CAPTCHA-gated phishing also declined. A short-lived April rise in business email compromise was attributed to a small number of high-volume campaigns rather than a sustained surge.
Attackers increasingly shifted to Microsoft Teams for social engineering, particularly vishing and fake IT-support interactions that abused remote-access tools such as Quick Assist; weekly malicious call attempts rose roughly 80% since the start of 2026 and reached nearly 10 times the mid-2025 baseline by late June. Microsoft also described a June automated BEC campaign that hit more than 67,000 users across 42,000 organizations in under three hours, along with a multi-stage phishing operation that used nested EML files, ICS invitations, Microsoft OAuth redirection, and a BAT dropper to deliver malware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By late June 2026, Microsoft said weekly malicious Microsoft Teams call attempts had risen to nearly ten times the mid-2025 baseline. The activity reflected a broader shift toward Teams-based social engineering and IT-support impersonation.
Microsoft documented a June 2026 phishing campaign that used nested EML files, ICS invitations, Microsoft OAuth redirection, and a BAT dropper to deliver malware. The campaign illustrated attackers' increasing use of multi-stage delivery chains.
In June 2026, Microsoft observed an automated business email compromise operation that targeted more than 67,000 users across 42,000 organizations in under three hours. The campaign was highlighted as one of the quarter's notable incidents.
Microsoft reported a short-lived increase in business email compromise activity in April 2026. It attributed the spike to a small number of high-volume campaigns rather than a sustained escalation.
Microsoft said its March takedown effort against the Tycoon2FA phishing-as-a-service platform led to a 92% drop in message volume from pre-disruption levels. The disruption was cited as a major factor shaping phishing activity in Q2 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecsoonline.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing workplace collaboration platforms, especially **Microsoft Teams**, to impersonate IT staff, vendors, and support personnel in social-engineering attacks that bypass user trust controls. Palo Alto Networks Unit 42 reported that collaboration-tool phishing accounted for **42%** of all phishing alerts seen in Cortex during the first four months of 2026, up from **30%** in the prior four-month period, showing a broader shift away from traditional email lures. The attacks commonly pressure users to approve multifactor authentication prompts or otherwise grant access, and researchers said both criminal and nation-state actors are using the technique. Cyfirma separately identified an active Teams-themed campaign that uses fake meeting transcript and recording notifications to lure victims to counterfeit landing pages hosted on compromised websites and attacker-controlled cloud infrastructure, including Cloudflare Workers and Pages. Victims are served a signed Windows installer that silently deploys a legitimate remote monitoring and management tool connected to attacker relay servers, then establishes persistence through a Windows service and registry changes, including mechanisms that survive Safe Mode with Networking. The intrusion chain also includes anti-analysis checks and credential theft via a credential provider DLL and an LSA authentication package, indicating the campaign is designed to convert a trusted collaboration message into durable unauthorized access.
Jun 29, 2026
Attackers used **Microsoft Teams** to impersonate IT or helpdesk staff and socially engineer employees into granting access or executing malicious actions, turning collaboration tooling and trusted support workflows into the initial access vector. One report describes a compromise at an Italy-based consumer services company where a Teams meeting invite and screen sharing session led the victim to run a staged **PowerShell** chain that deployed **PhantomBackdoor**, a multi-stage **WebSocket-based** backdoor associated with earlier spear-phishing activity. The observed sequence included post-call PowerShell execution, device reconnaissance, and establishment of WebSocket command-and-control. A second report describes a similar **vishing** intrusion in which a threat actor posing as support staff called employees through Teams and, after multiple attempts, convinced one user to grant remote access through **Quick Assist**. The attacker then directed the victim to a spoofed credential-harvesting site, used a malicious **MSI** and sideloaded **DLL** to launch follow-on payloads, and established outbound C2. While the malware families and exact post-compromise chains differ, both accounts document the same operational pattern: **Teams-based social engineering**, abuse of legitimate remote assistance or user-guided execution, credential theft or payload staging, and transition to hands-on intrusion activity inside a corporate environment.
Jun 29, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026