# Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026: Credential Phishing, BEC Surge and Teams-Based Phishing Growth

> Microsoft detected approximately 7.6 billion email-based phishing threats in Q2 2026, with monthly volume falling from 2.7 billion in April to 2.4 billion in June. Credential phishing remained the dominant payload objective, an automated BEC campaign on June 1, 2026 reached 67,000+ users across 42,000+ organizations in under three hours, and Microsoft Teams-based social engineering (vishing) kept growing.

- **Published:** 2026-10-14T06:42:02Z
- **Last reviewed:** 2026-10-14T06:42:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3474
- **ID:** TL-2026-3474
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft's Q2 2026 email threat landscape report (published 2026-07-23) and secondary coverage by KnowBe4 (2026-08-18) and SOC Prime (2026-07-27) describe a quarter shaped by the aftermath of the Microsoft Digital Crimes Unit / Europol disruption of the Tycoon2FA phishing-as-a-service (PhaaS) platform in early March 2026. Phishing volume linked to Tycoon2FA fell 92% from pre-disruption averages; the platform was forced off Cloudflare in late March and moved to .RU TLD registrations (40%+ of new domains in Q2). Its share of CAPTCHA-gated phishing dropped from 76% (Dec 2025) to 12% (Jun 2026) and of QR-code campaigns from 33% (Nov 2025) to 14% (Jun 2026); Microsoft states no single service replaced it at comparable scale. Credential phishing accounted for 94-96% of payload-based attacks each month. Q2 file-type mix was HTML 38%, PDF 27%, DOC/DOCX 9%, SVG 8%, ZIP/GZIP 6%. Attackers rotated delivery formats month to month: QR-code PDFs fell from 79% (April) to 58% (June) while DOC/DOCX rose to 40%; CAPTCHA-gated PDFs fell from 63% to 22% while SVG recovered from 5% to 26%; ICS calendar-invite files rose 277% in June.

BEC activity returned to historical norms after an anomalous April spike (about 9M messages, +121%, back to 3.9M in June). 87-92% of initial BEC contacts were generic 'Are you at your desk?' style outreach; explicit financial requests were 3-8%. The notable June 1, 2026 campaign ran 14:08-16:52 UTC, almost exclusively against US recipients (retail/consumer goods 17%, technology/software 15%, financial services 14%). It was sent with Python email.mime via the Amazon SES API from a DKIM-configured Slovak domain (ecajovna.sk), used reply-to domains ilyff.com, j-gmails.com and x2mails.com, embedded 1x1 open-tracking pixels with per-message identifiers, and used two successive lures: sales-executive impersonation (aging report / customer contact requests) and CEO/President impersonation (payroll diversion).

A second campaign on June 14-15, 2026 reached 107,000+ users across 19,000 organizations (US-focused; financial services 17%, technology 14%, retail 14%) impersonating 'Internal Affairs - Financials & Staff Updates' from 9i6pokerdepot.com (Postfix via Barracuda). It used nested EML plus ICS calendar invitations, an OAuth redirect to a ClickUp attachment host serving Financial_report.bat, a BAT dropper launching PowerShell, and installer.exe fetched from pixeldrain.com. An April 2026 'Code of Conduct' phishing wave used multi-stage delivery chains with AiTM token-compromise outcomes.

Teams-based phishing grew: Microsoft cites a 19% rise March to April and 10% into June in the secondary report; Microsoft's own post reports weekly malicious voice-phishing call attempts reaching nearly 10x the mid-2025 baseline, peaking 14:00-20:00 UTC Monday-Friday, with attackers moving from IT-branded to generic display names (52% of June attacks) and from support-themed to SaaS/update-themed domains. Teams messaging bypasses secure email gateways. No named threat actor, CVE or attribution is stated in the sources; this record is a trend-level report with campaign-level indicators.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1585.002 Email Accounts
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1684.001 Impersonation
- T1557 Adversary-in-the-Middle
- T1657 Financial Theft

## Sources

- [Email threat landscape: Q2 2026 trends and insights (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)
- [Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 (KnowBe4)](https://blog.knowbe4.com/microsoft-7-6-billion-phishing-emails-q2-2026)
- [Q2 2026 Email Threat Landscape: Emerging Trends and Tactics (SOC Prime)](https://socprime.com/active-threats/q2-2026-email-threat-landscape-emerging-trends-and-tactics/)
- [Email threat landscape: Q1 2026 trends and insights (Microsoft Security Blog)](https://microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights)
- [Cloudflare participates in global operation to disrupt Tycoon 2FA](https://www.cloudflare.com/en-gb/threat-intelligence/research/report/tycoon-2fa-takedown/)
- [Microsoft And Europol Lead Tycoon 2FA Takedown as Customer Identity Risks Rise (CX Today)](https://www.cxtoday.com/security-privacy-compliance/microsoft-and-europol-lead-tycoon-2fa-takedown-as-customer-identity-risks-rise/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3474