Microsoft's Q2 2026 email threat report details the sustained downstream impact of the Tycoon2FA PhaaS disruption (92% volume decline) alongside a broader shift toward alternative delivery mechanisms including QR codes, CAPTCHA-gated pages, and increasingly Microsoft Teams-based vishing. Two notable campaigns illustrate operational sophistication: a fully automated, API-driven BEC operation reaching tens of thousands of victims in hours, and a multi-stage credential-phishing-to-malware chain abusing Microsoft's OAuth silent sign-in flow and a legitimate ClickUp attachment host to deliver a PowerShell-based BAT dropper.
AitM
18 posts
Email threat landscape: Q2 2026 trends and insights What the ThreatLabz 2026 Phishing and Initial Access Report Means for the Public Sector | Zscaler The ThreatLabz 2026 Phishing and Initial Access Report highlights a shift towards highly targeted, AI-enabled phishing campaigns against the public sector. Despite a 20% overall drop in phishing volume, attackers are increasingly utilizing AI site builders, encrypted delivery channels, and AiTM/BiTM techniques to bypass traditional MFA and secure initial access.
Zscaler ThreatLabz 2026 Phishing and Initial Access Report The Zscaler ThreatLabz 2026 Phishing and Initial Access Report highlights a shift from high-volume phishing to highly targeted campaigns leveraging AI site builders and encrypted channels. Attackers are increasingly utilizing AiTM and BiTM techniques to bypass MFA, while conducting massive reconnaissance via cloud infrastructure to identify exposed entry points.
Home-Field Disadvantage: AiTM, QR-Code Phishing, and Infostealers at the 2026 FIFA World Cup Threat actors are proactively targeting the 2026 FIFA World Cup ecosystem, employing mobile-first malware, QR-code phishing against event organizers, and real-time AiTM phishing kits to bypass MFA. The campaigns leverage AI-generated infrastructure and urgency-based lures to distribute Android cryptominers, Windows infostealers, and compromise corporate Google Workspace accounts.
AI brands as bait: How threat actors are using the AI hype in social engineering Threat actors are increasingly leveraging the hype around AI platforms like ChatGPT, Claude, and DeepSeek to conduct social engineering attacks. These campaigns utilize phishing, malvertising, and SEO poisoning to distribute infostealers such as Vidar or facilitate credential theft via adversary-in-the-middle (AiTM) infrastructure.
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace Tycoon 2FA is a prolific Phishing-as-a-Service (PhaaS) platform utilizing Adversary-in-the-Middle (AiTM) techniques to bypass MFA and steal session tokens across Microsoft 365 and Google Workspace. The kit employs sophisticated evasion tactics, automated post-compromise reconnaissance, and establishes durable persistence mechanisms, such as Device-PRT in Entra ID, which survive standard session revocation procedures.
Welcome to BlackFile: Inside a Vishing Extortion Operation UNC6671, operating under the BlackFile brand, conducts sophisticated vishing and Adversary-in-the-Middle (AiTM) attacks to bypass MFA and compromise SSO platforms like Microsoft 365 and Okta. Once inside, the group uses automated Python and PowerShell scripts to rapidly exfiltrate sensitive data via APIs, often masking their activity as routine file access events, before launching aggressive extortion campaigns.
Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise A large-scale Adversary-in-the-Middle (AiTM) phishing campaign targeted over 35,000 users using sophisticated 'code of conduct' lures. The attack chain leveraged legitimate email services, PDF attachments, and multiple CAPTCHA gates to evade detection, ultimately proxying Microsoft 365 authentication sessions to steal tokens and bypass standard MFA.
Defending Against CORDIAL SPIDER and SNARKY SPIDER with Falcon Shield CORDIAL SPIDER and SNARKY SPIDER are executing rapid, SaaS-centric data theft and extortion campaigns by leveraging vishing and AiTM phishing pages. By capturing session tokens and authentication data, these actors bypass traditional endpoint defenses and pivot directly into SSO-integrated SaaS environments via the organization's Identity Provider (IdP).
Email threat landscape: Q1 2026 trends and insights In Q1 2026, Microsoft observed 8.3 billion email-based phishing threats, characterized by a 146% surge in QR code phishing and rapid evolution in CAPTCHA-gated payload delivery. Despite disruption efforts against the Tycoon2FA adversary-in-the-middle (AiTM) platform, threat actors quickly adapted their infrastructure, while Business Email Compromise (BEC) remained highly prevalent using conversational social engineering.
Token Bingo: Don’t Let Your Code be the Winner A widespread phishing campaign is leveraging the Kali365 Live Phishing-as-a-Service (PhaaS) platform to execute device code phishing and AiTM attacks. By tricking users into authorizing legitimate Microsoft device login requests, threat actors steal OAuth access and refresh tokens, bypassing traditional credential-based defenses and MFA to gain persistent access to Microsoft 365 environments.
Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees Storm-2755 is a financially motivated threat actor targeting Canadian organizations with 'payroll pirate' attacks. By leveraging SEO poisoning and Adversary-in-the-Middle (AiTM) techniques, the actor steals session tokens to bypass legacy MFA, maintains persistence using the Axios HTTP client, and alters direct deposit information to steal employee salaries.
SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks Russian military intelligence actor Forest Blizzard is compromising vulnerable SOHO routers to alter DNS settings and hijack network traffic. This compromised infrastructure is subsequently used to conduct selective Adversary-in-the-Middle (AiTM) attacks, intercepting TLS connections to steal credentials and sensitive data from targeted organizations.
APT28 exploit routers to enable DNS hijacking operations Russian state-sponsored threat actor APT28 is exploiting vulnerable SOHO routers to modify DHCP and DNS settings, redirecting user traffic to malicious infrastructure. This DNS hijacking facilitates Adversary-in-the-Middle (AitM) attacks designed to harvest credentials and OAuth tokens for web and email services.
New widespread EvilTokens kit: device code phishing as-a-service – Part 1 EvilTokens is a newly discovered Phishing-as-a-Service (PhaaS) platform that automates Microsoft device code phishing to facilitate Business Email Compromise (BEC). By tricking victims into authorizing a malicious device via legitimate Microsoft login portals, attackers harvest access and refresh tokens to gain persistent, unauthenticated access to Microsoft 365 environments.
Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown Following a major law enforcement takedown of its infrastructure on March 4, 2026, the Tycoon2FA Phishing-as-a-Service (PhaaS) platform has quickly reconstituted its operations. The platform continues to enable cybercriminals to bypass multifactor authentication (MFA) using Adversary-in-the-Middle (AiTM) techniques, leading to cloud account takeovers and Business Email Compromise (BEC).
Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale Tycoon2FA is a widespread Adversary-in-the-Middle (AiTM) Phishing-as-a-Service platform operated by the threat actor Storm-1747. It enables cybercriminals to bypass standard multifactor authentication (MFA) at scale by intercepting session cookies and credentials using spoofed sign-in pages, custom CAPTCHAs, and complex redirect chains.
Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations A coordinated international law enforcement and private sector operation successfully disrupted Tycoon 2FA, a prominent Phishing-as-a-Service (PhaaS) platform. The service enabled low-skill attackers to bypass multi-factor authentication (MFA) using adversary-in-the-middle (AitM) techniques to harvest credentials and session cookies, which were subsequently used for BEC and ransomware attacks.
