Microsoft says phishing shifted to Teams and BEC after Tycoon 2FA takedown
Phishing tied to the Tycoon 2FA platform fell 92 per cent from pre-disruption levels after its March takedown, but attackers moved to other methods, including business e-mail compromise and lures sent through Microsoft Teams, Microsoft said in a quarterly report covered July 24.
For small businesses on Microsoft 365, the lesson is that removing one criminal service changes tactics rather than ending the threat. CSO Online and Computerworld reported the findings from Microsoft's "Email threat picture: Q2 2026 trends and insights."
What changed
- Tycoon-linked volume fell 74 per cent in May to about 1.5 million messages, and another 20 per cent in June to about 1.2 million.
- Business e-mail compromise rose 121 per cent from March to April, then eased, ending at 3.9 million attacks in June, down from 9 million in March.
- Teams phishing rose 19 per cent from March to April and 10 per cent in June. Attackers used chats to build trust before stealing credentials or delivering malware.
- QR code phishing fell from 18.7 million attacks in March to 8.3 million in June.
Microsoft described one automated BEC campaign that reached 42,000 organizations in under three hours, and a multi-stage malware campaign aimed at 107,000 users that abused calendar invitations, Teams recordings and Microsoft's own sign-in redirects to look legitimate.
Another kit offline
Days earlier, on July 20, Germany's Federal Criminal Police Office (BKA) and the Frankfurt cybercrime prosecutors' office (ZIT), working with U.S. authorities, took down Kratos, an adversary-in-the-middle kit that grew out of Sneaky2FA and targeted Microsoft 365 accounts. Indonesian authorities arrested its developer and technical administrator, and more than 200 servers were shut down, Trend Micro said. More than 1,800 subscribers had run an estimated 15,000 campaigns a month; in November 2025 the kit added fake browser pop-up login windows designed to fool users who check the address bar.
What to do
- Adopt phishing-resistant MFA or passkeys, especially for finance staff and administrators.
- In Microsoft 365, turn on Safe Links and zero-hour auto purge, and restrict external Teams chats to trusted domains if you do not need open federation.
- Tell staff that a Teams message from an unknown "IT support" account deserves the same suspicion as an e-mail.
- Keep a call-back rule for any change in payment details.
