Tycoon2FA Disruption Drives Phishing Decline and New Attack Tactics

The disruption of the Tycoon2FA phishing-as-a-service platform drove a 92% decline in associated phishing activity, according to Microsoft’s Q2 2026 email threat report. QR code and CAPTCHA-gated phishing fell sharply, but attackers increasingly shifted toward Microsoft Teams social engineering, business email compromise, calendar invitations, and trusted cloud services. Microsoft also identified highly automated campaigns reaching tens of thousands of organizations and users within short periods. Organizations should strengthen email filtering and adopt passkeys, phishing-resistant MFA, Safe Links, and automated removal of malicious messages.

Reference: csoonline.com