Email phishing remains one of the most common ways attackers gain access to business accounts.
During the second quarter of 2026, criminals continued to use fake login pages, malicious attachments, and convincing business messages to steal credentials or deliver malware.
The problem is no longer limited to the inbox. Attackers are increasingly using collaboration tools to contact employees directly, posing as technical support staff and pressuring them to share access, run a tool, or visit a fraudulent site.
Microsoft analysts identified a sharp rise in phishing activity across email and Microsoft Teams, showing how attackers are moving between trusted workplace channels.
The activity combines high-volume email campaigns with voice phishing, also called vishing, that targets employees when they are active online.
The scale creates a serious challenge for organizations because many of these attacks rely on human trust rather than software flaws.
A message that looks routine, or a call that appears to come from internal IT, can be enough to start a costly compromise.
Microsoft said in a report shared with Cyber Security News (CSN) that it detected approximately 7.6 billion email-based phishing threats between April and June 2026.
Monthly volume fell slightly from 2.7 billion in April to 2.4 billion in June, but credential theft remained the main goal.
7.6 Billion Email Phishing Threats as Teams Vishing Attacks
Credential phishing made up 94 to 96 percent of malicious payload attacks observed during the quarter.
These campaigns typically direct victims to a fake sign-in page or load a copied login screen locally, allowing attackers to capture passwords and potentially bypass normal account controls.
HTML and PDF files were the most frequent delivery formats, together representing about 60 to 70 percent of payload-based attacks.
Users should remain cautious of unexpected documents, particularly because Microsoft 365 device code phishing campaigns can abuse legitimate authentication workflows instead of relying on obviously malicious websites.
QR-code phishing also remained a notable threat despite declining from its March peak of 18.7 million attacks to 8.3 million in June.
Most QR lures arrived in attachments, and attackers shifted between PDF and Word files as they adapted their methods, a pattern also seen in sophisticated QR code phishing operations.
Microsoft’s disruption of the Tycoon2FA phishing service helped reduce activity connected to the platform by 92 percent from pre-disruption levels.
However, the broader threat did not disappear, as actors diversified delivery methods, used trusted services, and continued to test new infrastructure.
One automated business email compromise campaign reached more than 67,000 users at over 42,000 organizations in less than three hours.
It used impersonated executive messages, aging-report requests, and payroll-diversion lures to start conversations with recipients before making fraudulent financial requests.
Teams Vishing Activity Surges
Microsoft Teams has become an attractive channel because messages and calls can appear more trustworthy than an unexpected email.
During Q2, Teams phishing detections rose 19 percent from March to April and increased another 10 percent in June.
Vishing showed the steepest growth. Weekly malicious call attempts increased roughly 80 percent since the beginning of 2026 and reached nearly 10 times the mid-2025 baseline by late June, with most activity occurring on weekdays between 14:00 and 20:00 UTC.
Attackers commonly impersonate IT support staff and warn victims about a supposed account lockout or security issue.
They increasingly use generic display names instead of obvious help-desk labels, while their email addresses use software, scanning, update, or infrastructure-related wording to appear credible.
This approach can lead to remote-access abuse, credential theft, or malware execution.
In one reported incident, a Teams support impersonation call persuaded an employee to provide access through Quick Assist, illustrating why Teams support call compromise attempts require immediate verification through an approved internal channel.
Organizations should review email-protection settings, enable post-delivery message removal, and turn on link and attachment protections.
They should also use phishing awareness training, adopt phishing-resistant multifactor authentication for privileged accounts, restrict untrusted external Teams communications, and disable remote-support tools that are not operationally necessary.
Security teams should investigate unexpected Teams calls, unusual external chats, and suspicious requests to run remote-access tools.
Monitoring both identity activity and endpoint behavior is essential, especially as external collaboration features abused in vishing campaigns can bypass traditional email-focused controls.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | 9i6pokerdepot[.]com | Sending domain; DKIM-signed by the operator |
| Email address | Customer.Service[@]9i6pokerdepot[.]com | Campaign sender address |
| Domain | t90141296286.p.clickup-attachments[.]com | ClickUp attachment subdomain hosting the stage 2 BAT dropper |
| URL | hxxps://t90141296286.p.clickup-attachments[.]com/t90141296286/fb39c3a9-3161-40ad-847b-0683e0409d6f/Financial_report.bat | Stage 2 BAT dropper download URL |
| URL | hxxps://pixeldrain[.]com/api/file/3v92oJiL | Final installer payload download URL |
| File name | Re: Teams Archive Recording for {{DATE2}}.eml | Nested EML attachment template name |
| File name | Financial_report.bat | Stage 2 dropper batch file |
| Domain | ecajovna[.]sk | Domain used to send campaign emails |
| Domain | ilyff[.]com | Reply-to domain used to receive victim responses |
| Domain | j-gmails[.]com | Reply-to domain used to receive victim responses |
| Domain | x2mails[.]com | Reply-to domain used to receive victim responses |
| Email address | contact[@]ecajovna[.]sk | Address used to send campaign emails |
| Email address | mail[@]ilyff[.]com | Reply-to address |
| Email address | me[@]j-gmails[.]com | Reply-to address |
| Email address | me[@]x2mails[.]com | Reply-to address |
| Domain | compliance-protectionoutlook[.]de | Domain hosting malicious campaign content |
| Domain | acceptable-use-policy-calendly[.]de | Domain hosting malicious campaign content |
| Domain | cocinternal[.]com | Domain hosting sender email address |
| Domain | gadellinet[.]com | Domain hosting sender email address |
| Domain | harteprn[.]com | Domain hosting sender email address |
| Email address | cocpostmaster[@]cocinternal[.]cm | Email address used to send campaign emails |
| Email address | nationaladmin[@]gadellinet[.]com | Email address used to send campaign emails |
| Email address | nationalintegrity[@]harteprn[.]com | Email address used to send campaign emails |
| Email address | m365premiumcommunications[@]cocinternal[.]com | Email address used to send campaign emails |
| Email address | documentviewer[@]na[.]businesshellosign[.]de | Email address used to send campaign emails |
| SHA-256 | 5DB1ECBBB2C90C51D81BDA138D4300B90EA5EB2885CCE1BD921D692214AECBC6 | File hash of campaign PDF attachment |
| SHA-256 | B5A3346082AC566B4494E6175F1CD9873B64ABE6C902DB49BD4E8088876C9EAD | File hash of campaign PDF attachment |
| SHA-256 | 11420D6D693BF8B19195E6B98FEDD03B9BCBC770B6988BC64CB788BFABE1A49D | File hash of campaign PDF attachment |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
