Q2 2026 Email Threat Landscape: Trends and Insights - SOC Prime

SOC Prime Bias: High 27 Jul 2026 15:04 UTC Microsoft Security Blog Q2 2026 Email Threat Landscape: Emerging Trends and Tactics SOC Prime Team Follow DETECTION STACK AIDR Alert ETL Query Threat Report Attack Flow Detections Simulations Summary The second quarter of 2026 brought a notable decline in Tycoon2FA phishing activity following disruption efforts, although threat actors adapted by shifting toward .RU domains. Credential phishing remained the leading email threat, while Microsoft Teams-based social engineering and vishing activity increased. New multi-stage campaigns also used nested EML files and calendar invitations to deliver malware through OAuth redirects. Investigation Microsoft Threat Intelligence examined changes in phishing delivery techniques, including a recurring shift between PDF and DOC/DOCX payloads. The investigation documented the reduction of CAPTCHA-gated and QR code phishing associated with the Tycoon2FA platform. Researchers also analyzed a multi-stage campaign that used a batch file dropper followed by a PowerShell-based downloader. Mitigation Organizations should deploy phishing-resistant MFA methods such as FIDO security keys or Windows Hello and enable Zero-hour auto purge (ZAP) in Microsoft Defender. Safe Links and Safe Attachments should be enabled together with network protection in Microsoft Defender for Endpoint. Security awareness programs should also include simulations focused on Microsoft Teams-based social engineering techniques. Response When suspicious AiTM activity is detected, responders should use Threat Explorer to locate and remove malicious emails. Teams should investigate unauthorized OAuth application registrations and monitor endpoints for suspicious PowerShell execution patterns. Any systems that execute unknown batch or executable files should be isolated immediately to prevent further compromise. Attack Flow Detections The Possibility of Execution Through Hidden PowerShell Command Lines (via cmdline) SOC Prime Team 27 Jul 2026 View Download or Upload via Powershell (via cmdline) SOC Prime Team 27 Jul 2026 View Windows Mail Client Creating Files With Executable Extension (via file_event) SOC Prime Team 27 Jul 2026 View IOCs (HashSha256) to detect: Email threat landscape: Q2 2026 trends and insights SOC Prime AI Rules 27 Jul 2026 View Silent Malware Execution via OAuth Redirect [Microsoft Windows Security Event Log] SOC Prime AI Rules 27 Jul 2026 View Detection of Hidden PowerShell Commands in Batch Files [Windows Powershell] SOC Prime AI Rules 27 Jul 2026 View Detect Highly Automated BEC Campaign Leveraging Amazon SES API [AWS Cloudtrail] SOC Prime AI Rules 27 Jul 2026 View Simulation Execution Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed. Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis. Attack Narrative & Commands: An adversary has successfully delivered a malicious .bat file to a victim’s machine via a spearphishing attachment. To evade detection by basic antivirus that might flag .ps1 files, the attacker uses a batch script to call PowerShell. The goal is to download and execute a secondary payload in memory. The attacker uses cmd.exe /c powershell to trigger the execution, hoping the transition from a simple batch file to a powerful shell goes unnoticed. Regression Test Script: # Simulation Script: Creating and executing a malicious-looking batch file $filePath = "$env:TEMPsimulate_attack.bat" $content = 'cmd.exe /c powershell -Command "Write-Output Simulated Malicious Payload Execution"' # Create the batch file Set-Content -Path $filePath -Value $content # Execute the batch file to trigger the detection rule Start-Process -FilePath "cmd.exe" -ArgumentList "/c $filePath" -Wait Cleanup Commands: # Cleanup: Remove the simulated batch file Remove-Item -Path "$env:TEMPsimulate_attack.bat" -ErrorAction SilentlyContinue Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts. JOIN FOR FREE BOOK A MEETING