{"id":14537,"date":"2026-07-24T10:04:42","date_gmt":"2026-07-24T10:04:42","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/24\/microsoft-detects-7-6-billion-email-phishing-threats-as-teams-vishing-attacks-increases-10-fold\/"},"modified":"2026-07-24T10:04:42","modified_gmt":"2026-07-24T10:04:42","slug":"microsoft-detects-7-6-billion-email-phishing-threats-as-teams-vishing-attacks-increases-10-fold","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/24\/microsoft-detects-7-6-billion-email-phishing-threats-as-teams-vishing-attacks-increases-10-fold\/","title":{"rendered":"Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold"},"content":{"rendered":"

Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Email phishing remains one of the most common ways attackers gain access to business accounts. <\/p>\n

During the second quarter of 2026, criminals continued to use fake login pages, malicious attachments, and convincing business messages to steal credentials or deliver malware.<\/p>\n

The problem is no longer limited to the inbox. Attackers are increasingly using collaboration tools to contact employees directly, posing as technical support staff and pressuring them to share access, run a tool, or visit a fraudulent site.<\/p>\n

Microsoft analysts identified a sharp rise in phishing activity across email and Microsoft Teams, showing how attackers are moving between trusted workplace channels. <\/p>\n

The activity combines high-volume email campaigns with voice phishing, also called vishing, that targets employees when they are active online.<\/a><\/p>\n

The scale creates a serious challenge for organizations because many of these attacks rely on human trust rather than software flaws. <\/p>\n

A message that looks routine, or a call that appears to come from internal IT, can be enough to start a costly compromise.<\/p>\n

Microsoft\u00a0said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that it detected approximately 7.6 billion email-based phishing threats between April and June 2026. <\/p>\n

Monthly volume fell slightly from 2.7 billion in April to 2.4 billion in June, but credential theft remained the main goal.<\/a><\/p>\n

7.6 Billion Email Phishing Threats as Teams Vishing Attacks<\/strong><\/h2>\n

Credential phishing made up 94 to 96 percent of malicious payload attacks observed during the quarter. <\/p>\n

These campaigns typically direct victims to a fake sign-in page or load a copied login screen locally, allowing attackers to capture passwords and potentially bypass normal account controls.<\/a><\/p>\n

HTML and PDF files were the most frequent delivery formats, together representing about 60 to 70 percent of payload-based attacks. <\/p>\n

Users should remain cautious of unexpected documents, particularly because\u00a0Microsoft 365 device code phishing<\/a>\u00a0campaigns can abuse legitimate authentication workflows instead of relying on obviously malicious websites.<\/p>\n

QR-code phishing also remained a notable threat despite declining from its March peak of 18.7 million attacks to 8.3 million in June. <\/p>\n

Most QR lures arrived in attachments, and attackers shifted between PDF and Word files as they adapted their methods, a pattern also seen in\u00a0sophisticated QR code phishing<\/a>\u00a0operations.<\/a><\/p>\n

Microsoft\u2019s disruption of the Tycoon2FA phishing service helped reduce activity connected to the platform by 92 percent from pre-disruption levels. <\/p>\n

\n
\"Rendered
Rendered example of payroll diversion email used in this campaign (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

However, the broader threat did not disappear, as actors diversified delivery methods, used trusted services, and continued to test new infrastructure.<\/a><\/p>\n

One automated business email compromise campaign reached more than 67,000 users at over 42,000 organizations in less than three hours. <\/p>\n

It used impersonated executive messages, aging-report requests, and payroll-diversion lures to start conversations with recipients before making fraudulent financial requests.<\/a><\/p>\n

Teams Vishing Activity Surges<\/strong><\/h2>\n

Microsoft Teams has become an attractive channel because messages and calls can appear more trustworthy than an unexpected email. <\/p>\n

\n
\"Rendered
Rendered sample of initial campaign email (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

During Q2, Teams phishing detections rose 19 percent from March to April and increased another 10 percent in June.<\/a><\/p>\n

Vishing showed the steepest growth. Weekly malicious call attempts increased roughly 80 percent since the beginning of 2026 and reached nearly 10 times the mid-2025 baseline by late June, with most activity occurring on weekdays between 14:00 and 20:00 UTC.<\/a><\/p>\n

Attackers commonly impersonate IT support staff and warn victims about a supposed account lockout or security issue. <\/p>\n

They increasingly use generic display names instead of obvious help-desk labels, while their email addresses use software, scanning, update, or infrastructure-related wording to appear credible.<\/a><\/p>\n

This approach can lead to remote-access abuse, credential theft, or malware execution. <\/p>\n

In one reported incident, a Teams support impersonation call persuaded an employee to provide access through Quick Assist, illustrating why\u00a0Teams support call compromise<\/a>\u00a0attempts require immediate verification through an approved internal channel.<\/a><\/p>\n

Organizations should review email-protection settings, enable post-delivery message removal, and turn on link and attachment protections.<\/p>\n

\n
\"Source
Source code of Financial_report.bat (Source \u2013 Microsoft) <\/figcaption><\/figure>\n<\/div>\n

They should also use phishing awareness training, adopt phishing-resistant multifactor authentication for privileged accounts, restrict untrusted external Teams communications, and disable remote-support tools that are not operationally necessary.<\/a><\/p>\n

Security teams should investigate unexpected Teams calls, unusual external chats, and suspicious requests to run remote-access tools. <\/p>\n

Monitoring both identity activity and endpoint behavior is essential, especially as\u00a0external collaboration features abused<\/a>\u00a0in vishing campaigns can bypass traditional email-focused controls.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
Domain<\/td>\n9i6pokerdepot[.]com<\/td>\nSending domain; DKIM-signed by the operator<\/td>\n<\/tr>\n
Email address<\/td>\nCustomer.Service[@]9i6pokerdepot[.]com<\/td>\nCampaign sender address<\/td>\n<\/tr>\n
Domain<\/td>\nt90141296286.p.clickup-attachments[.]com<\/td>\nClickUp attachment subdomain hosting the stage 2 BAT dropper<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/t90141296286.p.clickup-attachments[.]com\/t90141296286\/fb39c3a9-3161-40ad-847b-0683e0409d6f\/Financial_report.bat<\/td>\nStage 2 BAT dropper download URL<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/pixeldrain[.]com\/api\/file\/3v92oJiL<\/td>\nFinal installer payload download URL<\/td>\n<\/tr>\n
File name<\/td>\nRe: Teams Archive Recording for {{DATE2}}.eml<\/td>\nNested EML attachment template name<\/td>\n<\/tr>\n
File name<\/td>\nFinancial_report.bat<\/td>\nStage 2 dropper batch file<\/td>\n<\/tr>\n
Domain<\/td>\necajovna[.]sk<\/td>\nDomain used to send campaign emails<\/td>\n<\/tr>\n
Domain<\/td>\nilyff[.]com<\/td>\nReply-to domain used to receive victim responses<\/td>\n<\/tr>\n
Domain<\/td>\nj-gmails[.]com<\/td>\nReply-to domain used to receive victim responses<\/td>\n<\/tr>\n
Domain<\/td>\nx2mails[.]com<\/td>\nReply-to domain used to receive victim responses<\/td>\n<\/tr>\n
Email address<\/td>\ncontact[@]ecajovna[.]sk<\/td>\nAddress used to send campaign emails<\/td>\n<\/tr>\n
Email address<\/td>\nmail[@]ilyff[.]com<\/td>\nReply-to address<\/td>\n<\/tr>\n
Email address<\/td>\nme[@]j-gmails[.]com<\/td>\nReply-to address<\/td>\n<\/tr>\n
Email address<\/td>\nme[@]x2mails[.]com<\/td>\nReply-to address<\/td>\n<\/tr>\n
Domain<\/td>\ncompliance-protectionoutlook[.]de<\/td>\nDomain hosting malicious campaign content<\/td>\n<\/tr>\n
Domain<\/td>\nacceptable-use-policy-calendly[.]de<\/td>\nDomain hosting malicious campaign content<\/td>\n<\/tr>\n
Domain<\/td>\ncocinternal[.]com<\/td>\nDomain hosting sender email address<\/td>\n<\/tr>\n
Domain<\/td>\ngadellinet[.]com<\/td>\nDomain hosting sender email address<\/td>\n<\/tr>\n
Domain<\/td>\nharteprn[.]com<\/td>\nDomain hosting sender email address<\/td>\n<\/tr>\n
Email address<\/td>\ncocpostmaster[@]cocinternal[.]cm<\/td>\nEmail address used to send campaign emails<\/td>\n<\/tr>\n
Email address<\/td>\nnationaladmin[@]gadellinet[.]com<\/td>\nEmail address used to send campaign emails<\/td>\n<\/tr>\n
Email address<\/td>\nnationalintegrity[@]harteprn[.]com<\/td>\nEmail address used to send campaign emails<\/td>\n<\/tr>\n
Email address<\/td>\nm365premiumcommunications[@]cocinternal[.]com<\/td>\nEmail address used to send campaign emails<\/td>\n<\/tr>\n
Email address<\/td>\ndocumentviewer[@]na[.]businesshellosign[.]de<\/td>\nEmail address used to send campaign emails<\/td>\n<\/tr>\n
SHA-256<\/td>\n5DB1ECBBB2C90C51D81BDA138D4300B90EA5EB2885CCE1BD921D692214AECBC6<\/td>\nFile hash of campaign PDF attachment<\/td>\n<\/tr>\n
SHA-256<\/td>\nB5A3346082AC566B4494E6175F1CD9873B64ABE6C902DB49BD4E8088876C9EAD<\/td>\nFile hash of campaign PDF attachment<\/td>\n<\/tr>\n
SHA-256<\/td>\n11420D6D693BF8B19195E6B98FEDD03B9BCBC770B6988BC64CB788BFABE1A49D<\/td>\nFile hash of campaign PDF attachment<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

ALERT!: 20+ government sites delivered malware to businesses and citizens. <\/strong>See full attack research<\/strong><\/a> to check your own exposure.<\/strong><\/p>\n

The post Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold Email phishing remains one of the most common ways attackers gain access to business accounts. During the second quarter of 2026, criminals continued to use fake login pages, malicious attachments, and convincing business messages to steal credentials or deliver malware. The problem […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-14537","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14537"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=14537"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14537\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=14537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=14537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=14537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}