Email threat landscape: Q2 2026 trends and insights
2026-07-25T20:52:16Z•4c5c2ba221f2ef7e43b83ebf0a4468365e657356f4b8be270e8852bead4aceae
ACR StealerAI agentsAsyncAPICI/CD compromiseClickFixMFAMicrosoft Defender ExpertsMicrosoft Entra IDOAuth abuseShinyHuntersTeams social engineeringTycoon2FAauthentication tokensautomated attacksbrowser stealercredential theftcyber insuranceimport-time payloadincident responseleast privilegemulti-stage attack chainsnpm supply chainpasskeysphishingsupply chain attacks
What happened
Microsoft Security Blog (July 2026) highlights Q2 trends and multiple discrete incident analyses: Microsoft disruption of the Tycoon2FA phishing platform contributed to declines in several phishing techniques, but actors have shifted to Teams-based social engineering and increasingly automated, multi‑stage attacks. Notable investigations include ACR Stealer campaigns (late Apr–mid Jun 2026) using ClickFix lures to harvest browser credentials, tokens, and documents; an AsyncAPI npm supply‑chain compromise that abused trusted CI/CD workflows to deliver import‑time payloads; and OAuth abuse withT
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 4c5c2ba221f2ef7e43b83ebf0a4468365e657356f4b8be270e8852bead4aceae
- Enrichment time
- 2026-07-25T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.