Threat reportPhishingTL-2026-3474
Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026: Credential Phishing, BEC Surge and Teams-Based Phishing Growth
Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 (TL-2026-3474), also tracked as Tycoon2FA aftermath, is a medium-severity phishing campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Microsoft 365 / Exchange Online / Microsoft Teams, maps to 13 MITRE ATT&CK techniques (T1059.001, T1059.003, T1204.002), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3474
- Threat ID
- TL-2026-3474
- Also known as
- Tycoon2FA aftermath, June 1 2026 Amazon SES BEC campaign, Staff Updates EML/ICS campaign
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, technology, finance, consumer-goods
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026
Malware and tooling: Tycoon2FA
How Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 works
Microsoft detected approximately 7.6 billion email-based phishing threats in Q2 2026, with monthly volume falling from 2.7 billion in April to 2.4 billion in June. Credential phishing remained the dominant payload objective, an automated BEC campaign on June 1, 2026 reached 67,000+ users across 42,000+ organizations in under three hours, and Microsoft Teams-based social engineering (vishing) kept growing.
Microsoft's Q2 2026 email threat landscape report (published 2026-07-23) and secondary coverage by KnowBe4 (2026-08-18) and SOC Prime (2026-07-27) describe a quarter shaped by the aftermath of the Microsoft Digital Crimes Unit / Europol disruption of the Tycoon2FA phishing-as-a-service (PhaaS) platform in early March 2026. Phishing volume linked to Tycoon2FA fell 92% from pre-disruption averages; the platform was forced off Cloudflare in late March and moved to .RU TLD registrations (40%+ of new domains in Q2). Its share of CAPTCHA-gated phishing dropped from 76% (Dec 2025) to 12% (Jun 2026) and of QR-code campaigns from 33% (Nov 2025) to 14% (Jun 2026); Microsoft states no single service replaced it at comparable scale. Credential phishing accounted for 94-96% of payload-based attacks each month. Q2 file-type mix was HTML 38%, PDF 27%, DOC/DOCX 9%, SVG 8%, ZIP/GZIP 6%. Attackers rotated delivery formats month to month: QR-code PDFs fell from 79% (April) to 58% (June) while DOC/DOCX rose to 40%; CAPTCHA-gated PDFs fell from 63% to 22% while SVG recovered from 5% to 26%; ICS calendar-invite files rose 277% in June.
BEC activity returned to historical norms after an anomalous April spike (about 9M messages, +121%, back to 3.9M in June). 87-92% of initial BEC contacts were generic 'Are you at your desk?' style outreach; explicit financial requests were 3-8%. The notable June 1, 2026 campaign ran 14:08-16:52 UTC, almost exclusively against US recipients (retail/consumer goods 17%, technology/software 15%, financial services 14%). It was sent with Python email.mime via the Amazon SES API from a DKIM-configured Slovak domain (ecajovna.sk), used reply-to domains ilyff.com, j-gmails.com and x2mails.com, embedded 1x1 open-tracking pixels with per-message identifiers, and used two successive lures: sales-executive impersonation (aging report / customer contact requests) and CEO/President impersonation (payroll diversion).
A second campaign on June 14-15, 2026 reached 107,000+ users across 19,000 organizations (US-focused; financial services 17%, technology 14%, retail 14%) impersonating 'Internal Affairs - Financials & Staff Updates' from 9i6pokerdepot.com (Postfix via Barracuda). It used nested EML plus ICS calendar invitations, an OAuth redirect to a ClickUp attachment host serving Financial_report.bat, a BAT dropper launching PowerShell, and installer.exe fetched from pixeldrain.com. An April 2026 'Code of Conduct' phishing wave used multi-stage delivery chains with AiTM token-compromise outcomes.
Teams-based phishing grew: Microsoft cites a 19% rise March to April and 10% into June in the secondary report; Microsoft's own post reports weekly malicious voice-phishing call attempts reaching nearly 10x the mid-2025 baseline, peaking 14:00-20:00 UTC Monday-Friday, with attackers moving from IT-branded to generic display names (52% of June attacks) and from support-themed to SaaS/update-themed domains. Teams messaging bypasses secure email gateways. No named threat actor, CVE or attribution is stated in the sources; this record is a trend-level report with campaign-level indicators.
MITRE ATT&CK techniques used in TL-2026-3474
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Credential Access
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service; T1566.004 Spearphishing Voice
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1585.002 Email Accounts
Impact
Defense Evasion
Affected products and versions in Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026
- Microsoft — Microsoft 365 / Exchange Online / Microsoft Teams
Vulnerable versions: all tenants without phishing-resistant MFA and external-Teams restrictions
Remediation for Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026
Immediate actions
- Block and hunt for the listed domains, URLs, sender addresses and SHA-256 hashes in mail, proxy and endpoint telemetry
- Enable Zero-Hour Auto Purge (ZAP), Safe Links and Safe Attachments in Defender for Office 365
- Alert on .bat or PowerShell execution spawned from downloaded attachments and on downloads from pixeldrain.com or clickup-attachments.com
Workarounds
- Restrict external Teams chat/calls to allow-listed tenants
- Use Microsoft Edge with SmartScreen
- Require out-of-band verification for payroll-change and payment-detail requests
Longer-term hardening
- Deploy phishing-resistant MFA (Windows Hello, FIDO2 keys, Microsoft Authenticator passwordless) and conditional access for privileged accounts
- Run attack-simulation training that includes Teams-based vishing scenarios and BEC payroll-diversion pretexts
- Enable automatic attack disruption in Defender XDR and network protection in Defender for Endpoint
Timeline of Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026
- Microsoft Digital Crimes Unit and Europol, with Cloudflare, disrupt the Tycoon2FA PhaaS platform in early March 2026 (exact day not stated in the sources; 300+ domains seized). Tycoon2FA-linked phishing later fell 92% from pre-disruption averages.
- Anomalous BEC spike in April 2026 (about 9M messages, +121%); Teams phishing up 19% March to April; April 'Code of Conduct' multi-stage phishing wave with AiTM token-compromise outcomes.
- Automated BEC campaign (Python email.mime via Amazon SES, sender ecajovna.sk) runs 14:08-16:52 UTC, reaching 67,000+ users in 42,000+ organizations, almost exclusively in the US, with aging-report and payroll-diversion lures.
- Multi-stage 'Internal Affairs - Financials & Staff Updates' campaign begins (June 14-15), reaching 107,000+ users in 19,000 organizations via nested EML/ICS, OAuth redirect, ClickUp-hosted Financial_report.bat, PowerShell and a pixeldrain-hosted installer.exe.
- Microsoft publishes 'Email threat landscape: Q2 2026 trends and insights' reporting about 7.6 billion phishing threats (2.7 billion in April, 2.4 billion in June).
- SOC Prime publishes a detection-focused summary of the Q2 2026 email threat landscape.
- KnowBe4 publishes its summary of Microsoft's Q2 2026 findings, highlighting the June 1 BEC campaign and Teams phishing growth.
Sources cited for Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026
- Email threat landscape: Q2 2026 trends and insights (Microsoft Security Blog)
- Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 (KnowBe4)
- Q2 2026 Email Threat Landscape: Emerging Trends and Tactics (SOC Prime)
- Email threat landscape: Q1 2026 trends and insights (Microsoft Security Blog)
- Cloudflare participates in global operation to disrupt Tycoon 2FA
- Microsoft And Europol Lead Tycoon 2FA Takedown as Customer Identity Risks Rise (CX Today)
Detection coverage for TL-2026-3474
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3474 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3474
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.