Q2 2026 Email Threat Landscape: Emerging Trends and Tactics

Summary

The second quarter of 2026 brought a notable decline in Tycoon2FA phishing activity following disruption efforts, although threat actors adapted by shifting toward .RU domains. Credential phishing remained the leading email threat, while Microsoft Teams-based social engineering and vishing activity increased. New multi-stage campaigns also used nested EML files and calendar invitations to deliver malware through OAuth redirects.

Investigation

Microsoft Threat Intelligence examined changes in phishing delivery techniques, including a recurring shift between PDF and DOC/DOCX payloads. The investigation documented the reduction of CAPTCHA-gated and QR code phishing associated with the Tycoon2FA platform. Researchers also analyzed a multi-stage campaign that used a batch file dropper followed by a PowerShell-based downloader.

Mitigation

Organizations should deploy phishing-resistant MFA methods such as FIDO security keys or Windows Hello and enable Zero-hour auto purge (ZAP) in Microsoft Defender. Safe Links and Safe Attachments should be enabled together with network protection in Microsoft Defender for Endpoint. Security awareness programs should also include simulations focused on Microsoft Teams-based social engineering techniques.

Response

When suspicious AiTM activity is detected, responders should use Threat Explorer to locate and remove malicious emails. Teams should investigate unauthorized OAuth application registrations and monitor endpoints for suspicious PowerShell execution patterns. Any systems that execute unknown batch or executable files should be isolated immediately to prevent further compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully delivered a malicious .bat file to a victim’s machine via a spearphishing attachment. To evade detection by basic antivirus that might flag .ps1 files, the attacker uses a batch script to call PowerShell. The goal is to download and execute a secondary payload in memory. The attacker uses cmd.exe /c powershell to trigger the execution, hoping the transition from a simple batch file to a powerful shell goes unnoticed.

• Regression Test Script:

  # Simulation Script: Creating and executing a malicious-looking batch file
  $filePath = "$env:TEMPsimulate_attack.bat"
  $content = 'cmd.exe /c powershell -Command "Write-Output Simulated Malicious Payload Execution"'
  
  # Create the batch file
  Set-Content -Path $filePath -Value $content
  
  # Execute the batch file to trigger the detection rule
  Start-Process -FilePath "cmd.exe" -ArgumentList "/c $filePath" -Wait

• Cleanup Commands:

  # Cleanup: Remove the simulated batch file
  Remove-Item -Path "$env:TEMPsimulate_attack.bat" -ErrorAction SilentlyContinue