INTEL_REPORT
Microsoft Security Blog · published 4/30/2026, 3:00:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Email threat landscape: Q1 2026 trends and insights In early 2026, email threats increased with a rise in credential phishing, QR code phishing, and CAPTCHA-gated campaigns, highlighted by Microsoft’s disruption of the Tycoon2FA phishing platform which led to a 15% volume decrease and shifts in threat actor tactics. The post Email threat landscape: Q1 2026 trends and insights appeared first on Microsoft Security Blog . In this article Tycoon2FA disruption impact QR code phi…
https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights
sha256:617410fb97ab321defa6e8483d4a87d2fd0a8c0c240e44781c92dabdbe5ceb6d
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| domain |
| us02web.zoom.nl |
| Open → |
| domain | awstrack.me | Open → |