Key takeaways

• Takedowns work: Tycoon2FA phishing fell from a monthly average of 15.1 million messages in late 2025 to 1.2 million in June 2026, and no single service replaced it at that scale.
• Teams is the new target: weekly malicious call attempts (vishing) on Microsoft Teams reached almost 10x the mid-2025 baseline.
• QR codes and CAPTCHAs declined: CAPTCHA-gated phishing fell 81% from its March peak, and QR code phishing (quishing) returned to mid-2025 levels.
• Calendar invites are weaponized: malicious ICS files rose 277% in June.
• Credential phishing still dominates: it made up 94–96% of payload attacks, with malware and infostealers at 4–6%.

What happened to Tycoon2FA in 2026?

Microsoft’s Digital Crimes Unit (DCU) disrupted Tycoon2FA, a phishing-as-a-service (PhaaS) platform built to bypass multi-factor authentication, in March 2026. By June, phishing volume linked to the platform had dropped 92%, from a monthly average of 15.1 million messages in late 2025 to 1.2 million.

The takedown also hit the tactics Tycoon2FA relied on most:

• CAPTCHA-gated phishing: down 81% from its March peak, closing the quarter at 2.2 million attacks, its lowest point in over a year. Tycoon2FA’s share of these sites fell from 76% in late 2025 to 12% in June.
• QR code phishing (quishing): fell steadily through the quarter and ended June at 8.3 million attacks, back to mid-2025 levels.

Do phishing takedowns actually work?

Yes. The Tycoon2FA case is measurable proof: removing the infrastructure behind a phishing service cut its volume by 92% within three months, and no replacement service filled the gap at a comparable scale. Takedowns do not end phishing, but they raise the cost for attackers and buy time for defenders.

The same principle applies to brand impersonation. Removing lookalike domains, fake login pages and impersonation accounts quickly shortens the window in which they can steal credentials.

How are attackers delivering phishing payloads in 2026?

Microsoft detected 7.6 billion email phishing threats in Q2 2026. HTML and PDF attachments still carried 60 to 70% of malicious payloads, but attackers rotated formats to avoid static detection.

The table summarizes the main delivery shifts:

Why are calendar invites (ICS files) used for phishing?

Calendar invites are processed differently from standard email attachments. An ICS file can place a malicious link directly in a user’s calendar, so the victim may see it as a meeting rather than an email, and no “open the attachment” step is needed.

What is Teams vishing and why is it growing?

Teams vishing is voice phishing through Microsoft Teams calls, where an attacker poses as IT support, a colleague or a vendor to steal credentials or get remote access. By the end of Q2 2026, weekly malicious Teams call attempts reached almost ten times the mid-2025 baseline.

It works because a call inside a trusted workplace app feels more legitimate and urgent than a cold email. As email filters improve, attackers move social engineering into the tools employees already trust.

How fast can automated BEC campaigns spread?

Very fast. Microsoft observed one highly automated BEC campaign that reached 67,000 users across 42,000 organizations in under three hours.

What should security teams do with these findings?

Security teams should treat Q2 2026 as a sign that defense must follow attackers across channels:

1. Extend phishing awareness and reporting to Teams calls and chats, not only email.
2. Restrict external Teams access, and flag calls from outside the organization.
3. Inspect calendar invites and ICS attachments, not only standard file types.
4. Keep MFA, but prefer phishing-resistant methods, since PhaaS kits target MFA codes.
5. Monitor and take down lookalike domains and fake login pages that impersonate your brand.

How PhishFort helps

Tycoon2FA showed that removing phishing infrastructure cuts attack volume. PhishFort Brand Protection applies the same approach to your brand: it detects lookalike domains, fake login pages and impersonation accounts and takes them down with registrars, hosts and platforms.

Frequently asked questions

Sources

• Microsoft Security Blog: Email threat landscape Q2 2026, trends and insights (July 23, 2026)

Thanks to Microsoft Threat Intelligence and the Microsoft Defender Security Research Team for this research. Threat hunters and SOC analysts can find indicators of compromise (IOCs) and detection guidance in the original report.