After Tycoon2FA Was Shut Down, Phishing Criminals Went Looking for New Tricks
Microsoft's Q2 2026 email threat report shows that busting a major phishing-for-hire service slashed attack volume by 92%, but criminals quickly pivoted to Microsoft Teams chats and automated campaigns that hit tens of thousands of organisations in hours.
Key points
- Phishing volume linked to the Tycoon2FA service fell 92% after authorities disrupted it, according to Microsoft's Q2 2026 email threat report.
- A single automated business email compromise campaign reached more than 67,000 users in under three hours during Q2 2026.
- Microsoft Teams-based phishing attacks rose 19% from March to April 2026 and kept climbing through June.
- QR code phishing peaked at 18.7 million attacks in March 2026 before dropping to 8.3 million in June 2026.
- Microsoft recommends passwordless sign-in and automatic removal of malicious emails already sitting in inboxes.
A major crackdown on one of the internet's biggest phishing-for-hire services has changed what email fraud looks like, at least for now. Microsoft's quarterly email threat report, first covered by CSO Online, shows that shutting down the Tycoon2FA platform, a service that let criminals rent ready-made phishing kits the way a business rents software, slashed the volume of fake emails it powered by 92%. Criminals adapted fast.
What was Tycoon2FA, and why does its takedown matter?
Tycoon2FA was a phishing-as-a-service platform: it sold ready-to-use fraud tools to criminals who lacked the technical skill to build their own. Customers paid a fee and received everything needed to send convincing fake login pages and steal passwords at scale.
At its height, the platform was behind 12% of all QR code phishing attacks (where criminals hide a malicious link inside a scannable square image) and 14% of CAPTCHA-gated phishing attacks (where victims see a "prove you're human" puzzle before being handed a fake login page). After the disruption, monthly message volume from Tycoon2FA-linked campaigns fell to just 1.2 million in June 2026, the lowest figure Microsoft had recorded in at least a year. We first reported on Tycoon2FA on 24 July 2026, around the same time German police were shutting down the Kratos phishing network, whose 1,800 customers were already shopping for a replacement: a pattern that keeps repeating.
How did criminals respond?
They found other doors. The most notable shift was a move to Microsoft Teams, the workplace chat app used by millions of office workers.
Victims received a Teams message from an account that looked like a colleague or supplier. Criminals built trust through conversation before attempting credential theft or delivering malware, software designed to damage or spy on a device. Teams-based attacks rose 19% from March to April 2026, held roughly flat in May, then climbed another 10% into June.
Two specific campaigns stood out.
| Campaign | Scale | Method |
|---|---|---|
| Automated BEC campaign | 67,000+ users reached | Scripted emails via Amazon SES with engagement tracking |
| Multi-stage phishing campaign | 107,000 users targeted | EML files, calendar invites, Microsoft auth redirect |
| QR code phishing (March peak) | 18.7 million attacks | Malicious link hidden in scannable image |
| QR code phishing (June) | 8.3 million attacks | Same method, lower volume |
| CAPTCHA phishing (March) | 12 million attacks | Fake "prove you're human" page |
| CAPTCHA phishing (June) | 2.2 million attacks | Same method, lower volume |
Business email compromise, or BEC, is fraud where criminals impersonate a boss or supplier by email to trick staff into transferring money or sharing sensitive data. That category spiked 121% between March and April before pulling back in May.
Should you worry about Microsoft Teams specifically?
Yes, and here's why the channel shift matters more than the headline number. A staff member trained to spot a suspicious email may not apply the same instinct to a friendly Teams message. The attack surface widened precisely because the conversation feels low-stakes.
What should ordinary people actually do?
Microsoft's defensive advice held steady despite the shifting threat. The company recommends moving away from traditional passwords, using tools like Windows Hello (sign-in by face or fingerprint), physical security keys called FIDO keys, or the Microsoft Authenticator app. Microsoft is already pushing passkeys as the default for business accounts from September 2026, with SMS codes going dark entirely by February 2027.
For organisations, the report calls for enabling Zero-hour Auto Purge, a feature inside Microsoft Defender for Office 365 that automatically deletes a malicious email from an employee's inbox even after delivery, before anyone opens it.
Turn on automatic purge for delivered mail. Treat any Teams message that eventually wants a password or payment approval with the same suspicion you'd give a cold-call asking for your bank details. One platform goes down, three tactics appear. That's the postmortem template nobody's figured out how to escape yet.
