Email threat landscape: Q2 2026 trends and insights

Microsoft Security Blog (Jul 2026) highlights broad email and supply-chain threat activity and defensive guidance: disruption of the Tycoon2FA phishing platform contributed to declines in several phishing techniques, but actors have shifted to Teams-based social engineering and more automated, multi-stage attack chains. Microsoft observed active ACR Stealer campaigns (late Apr–mid Jun 2026) using ClickFix lures to exfiltrate browser credentials, authentication tokens, and sensitive documents. Separately, an AsyncAPI npm supply‑chain compromise weaponized CI/CD and import‑time payload delivery.