Microsoft takedown of Tycoon2FA cuts phishing by 92% in Q2 2026

The Q2 2026 Email Threat Landscape report highlights significant shifts in phishing activity, particularly the impact of Microsoft's disruption of the Tycoon2FA phishing-as-a-service platform. Following the disruption, phishing linked to Tycoon2FA decreased by 92%, with no new platform emerging to fill its void. Key findings include: 1) Email phishing attempts totaled approximately 7.6 billion, with a decline in malicious attempts from April to June.

2) Credential phishing dominated with 94-96% of payloads, while business email compromise (BEC) activity returned to historical levels. 3) Notable trends in social engineering, especially in Microsoft Teams, where voice phishing (vishing) increased significantly. 4) Recommendations for organizations include enhancing email protections, user awareness training, and enabling automated defenses in Microsoft Defender to mitigate ongoing threats.