Email threat landscape: Q2 2026 trends and insights
2026-07-26T02:52:14Z•c4e45e25287a4949370ae3c2fa53a4ca6e0e9f854cb11aee84d4f0c2eda8e6d6
ACR StealerAI agentsAXA XLAsyncAPICI/CD compromiseClickFixEntra IDMicrosoft Defender ExpertsOAuth abuseShinyHuntersTeams social engineeringTycoon2FAauthentication tokensautomationcredential theftguest access misconfigurationincident responseleast privilegemulti-stage attacksnpm supply chainpasskeysphishingsupply-chain attacksvishing
What happened
Microsoft Security Blog (July 2026) highlights Q2 trends and multiple active threats: disruption of the Tycoon2FA phishing platform contributed to declines in some phishing techniques, but adversaries have pivoted to Teams-based social engineering, automated multi-stage attack chains, and increased OAuth abuse (ShinyHunters-style) including vishing and guest-access misconfiguration. Notable incidents include ACR Stealer campaigns (late Apr–Jun 2026) using ClickFix lures to exfiltrate browser credentials, tokens, and documents, and a supply-chain compromise of AsyncAPI npm packages that weapon‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- c4e45e25287a4949370ae3c2fa53a4ca6e0e9f854cb11aee84d4f0c2eda8e6d6
- Enrichment time
- 2026-07-26T02:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.