Email threat landscape: Q2 2026 trends and insights
2026-07-25T02:52:15Z•b3731515b9fb13652cf63660abe28fb254adb3a3b70b16883b6f4de111f4ddd8
ACR StealerAI agentsAXA XLAsyncAPICI/CD compromiseClickFixMicrosoft Entra IDOAuth abuseShinyHuntersauthentication tokensautomationcredential theftcyber insuranceimport-time payloadincident responseleast privilegemisconfigured guest accessmulti-stage attacksnpm supply chainpasskeysphishingsupply chain securityteams social engineeringtycoon2favishing
What happened
Microsoft Security Blog posts (July 2026) report several active, high-risk trends: disruption of the Tycoon2FA phishing platform contributed to declines in some phishing techniques, but adversaries shifted to Teams-based social engineering and more automated, multi-stage attack chains. Microsoft observed increased ACR Stealer activity (late Apr–mid Jun 2026) using ClickFix lures to exfiltrate browser credentials, authentication tokens, and sensitive documents. A supply-chain compromise of AsyncAPI npm packages weaponized CI/CD workflows to deliver import-time payloads. Threat activity with Shy
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- b3731515b9fb13652cf63660abe28fb254adb3a3b70b16883b6f4de111f4ddd8
- Enrichment time
- 2026-07-25T02:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.