Microsoft Details Q1 2026 Email Threat Trends, Including QR-Code and CAPTCHA Phishing Surge
Summary
Microsoft reports QR-code phishing rose 146% from January to March 2026, while CAPTCHA-gated phishing reached 11.9 million attacks in March. Tycoon2FA activity fell after disruption; BEC totaled about 10.7 million attacks in Q1.
Key points
- QR-code phishing increased from 7.6 million attacks in January to 18.7 million in March; PDF attachments were the leading delivery method.
- CAPTCHA-gated phishing rose 125% in March to 11.9 million attacks, with attackers rotating payload formats to evade scanning.
- After a Microsoft-led disruption in early March, Tycoon2FA-linked message volume fell 15%; Microsoft also observed reduced access to active phishing pages and subsequent infrastructure changes.
- A February campaign sent more than 1.2 million messages to users at over 53,000 organizations in 23 countries; opened SVG attachments led to a CAPTCHA and credential-harvesting page.
- Credential phishing made up about 94% of malicious payloads in March. A separate March HTML campaign involved more than 1.5 million messages and infrastructure associated with Tycoon2FA, Kratos, and EvilTokens.
- Business email compromise totaled about 10.7 million attacks in Q1; generic outreach accounted for 82–84% of initial-contact messages.
- Microsoft recommends measures including Safe Links and Safe Attachments, Zero-hour auto purge, phishing simulations, and passwordless authentication.
Article Details
- Publisher
- Microsoft Threat Intelligence
- Report Period
- Q1 2026
- Scope
- Email threat activity, including phishing techniques, payload delivery, PhaaS infrastructure, and business email compromise.
- Key Statistics
- QR-code phishing increased 146%, from 7.6 million attacks in January to 18.7 million in March 2026.
- CAPTCHA-gated phishing increased 125% in March to 11.9 million attacks.
- Microsoft reported approximately 10.7 million BEC attacks in Q1 2026.
- A February 23–25 campaign sent more than 1.2 million messages to users at more than 53,000 organizations in 23 countries.
- A March 17 campaign involved more than 1.5 million confirmed malicious messages sent to over 179,000 organizations in 43 countries.
- Recommendations
- Review recommended Exchange Online Protection and Microsoft Defender for Office 365 settings.
- Invest in user awareness training and phishing simulations.
- Enable Zero-hour auto purge (ZAP), Safe Links, and Safe Attachments in Microsoft Defender for Office 365.
- Enable network protection in Microsoft Defender for Endpoint.
- Enable passwordless authentication where supported; use authenticator apps for accounts that still require passwords.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | bouleversement[.]niovapahrm[.]com | Hostname used by a malicious SVG attachment to fetch CAPTCHA-gated phishing content. |
| HOSTNAME | haematogenesis[.]hvishay[.]com | Hostname used by a malicious SVG attachment to fetch CAPTCHA-gated phishing content. |
| HOSTNAME | ubiquitarianism[.]drilto[.]com | Hostname used by a malicious SVG attachment to fetch CAPTCHA-gated phishing content. |
MITRE ATT&CK
T1204 · User ExecutionUsers had to open attachments or complete fake CAPTCHA challenges to reach phishing content.T1557 · Adversary-in-the-MiddleThe article describes adversary-in-the-middle techniques used by Tycoon2FA to attempt to defeat non-phishing-resistant MFA.T1566 · PhishingEmail-based phishing campaigns used credential-harvesting content, attachments, embedded QR codes, and staged landing pages.T1566.001 · Spearphishing AttachmentMalicious HTML, PDF, SVG, DOC/DOCX, and ZIP attachments delivered phishing content.T1566.002 · Spearphishing LinkPhishing links and QR codes in email bodies redirected users to phishing sites.
Threat Actors
Vendors
Products
Exchange Online ProtectionReview the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to ensure your organization has established essential defenses and knows how to monitor and respond to threat activity.Microsoft Defender for EndpointEnable network protection in Microsoft Defender for Endpoint.Microsoft Defender for Office 365Review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to ensure your organization has established essential defenses and knows how to monitor and respond to threat activity.Microsoft Defender XDRConfigure automatic attack disruption in Microsoft Defender XDR.
Tools
EvilTokensLarge, concentrated campaigns (multiâmillion messages) abused varied PhaaS providers—Tycoon2FA, Kratos, and EvilTokens—to host final phishing payloads and staging pages.KratosLarge, concentrated campaigns (multiâmillion messages) abused varied PhaaS providers—Tycoon2FA, Kratos, and EvilTokens—to host final phishing payloads and staging pages.Tycoon2FADisruption of the Tycoon2FA PhaaS in early March reduced access to active phishing pages and email volumes temporarily, though the actor adapted by changing hosting providers and TLD registration patterns.