Microsoft's disruption of the Tycoon2FA phishing platform in the second quarter of 2026 has contributed to sustained declines in major phishing techniques. However, threat actors are adapting by expanding into Teams-based social engineering and employing more automated, multi-stage attack chains.