Teams Phishing Rises After Tycoon2FA Takedown

How the attack worked

After Microsoft disrupted the Tycoon2FA phishing-as-a-service platform, phishing volume tied to that service dropped 92%, including declines in QR code and CAPTCHA-gated phishing. Rather than stopping, attackers shifted tactics. One notable adaptation was using Microsoft Teams as a social engineering channel, where attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. Separately, Microsoft observed a multi-stage phishing campaign that used nested EML files, calendar invitations, and a Microsoft authentication redirect to deliver malware, abusing trusted cloud infrastructure to disguise the attack.

Why it succeeded

These campaigns succeeded by exploiting trust in familiar tools rather than obviously suspicious external senders. A Teams message from what appears to be internal IT does not carry the same skepticism as an unknown email. Similarly, calendar invites and Microsoft authentication redirects look like normal workflow steps, making it easy for a target to click through without questioning the process. On top of this, Microsoft also observed a highly automated BEC campaign using scripted emails, Amazon SES, and engagement tracking, reaching tens of thousands of users in a very short window, showing attackers can scale trust-based tactics quickly.

What to watch for

• Unsolicited Teams chats from "IT" or helpdesk accounts initiating a trust-building conversation before asking for credentials or files
• Pressure to share login details or MFA codes inside a chat rather than through normal support channels
• Emails containing nested .EML attachments or unexpected calendar invites used as a delivery mechanism
• Being routed through an authentication flow that doesn't match the task at hand
• Generic but urgent emails designed to prompt a fast reply, especially around payment or invoice changes

Building resistance

Organizations should not treat Teams messages as automatically safe just because they arrive on an internal platform. Employees should be trained to question unexpected calendar invites, login redirects, or file requests, even when they appear to come from legitimate-looking Microsoft 365 workflows. Microsoft recommends blocking emails containing known bad URLs or subject fields and moving toward passwordless authentication or MFA for accounts that still require passwords. Complementing email filtering with phishing-resistant authentication, such as passkeys and phishing-resistant MFA, reduces the effectiveness of credential theft attempts even when a message gets through. Because automated BEC campaigns can reach tens of thousands of users within hours, fast reporting and response to suspicious messages remain essential, particularly for finance, accounts payable, executives, and IT/service desk staff who are frequently targeted.

Why did phishing shift to Microsoft Teams after the Tycoon2FA takedown?

Microsoft reported phishing volume linked to Tycoon2FA fell 92% after the disruption, so attackers adapted by using Microsoft Teams as a new social engineering channel to build trust before stealing credentials or delivering malware.

What is the calendar invite phishing technique described in this report?

A multi-stage campaign used nested EML files, calendar invitations, and a Microsoft authentication redirect to deliver malware, disguising the attack behind trusted Microsoft 365 infrastructure.

How fast can automated BEC campaigns spread?

Microsoft observed one automated BEC campaign reach 42,000 organizations in under three hours, and another reach over 67,000 users using scripted emails and engagement tracking.

What defenses does Microsoft recommend against these tactics?

Microsoft recommends blocking known bad URLs and subject fields, and moving toward passwordless or phishing-resistant MFA to reduce the impact of credential theft attempts.