Research & reports
Monthly briefs, controlled studies and annual analyses. Every report carries its number, its methodology, and its findings as discrete claims you can check.
Trends in Spam, Phishing, Spoofing, Malware & DNS Abuse
July 2026 monthly research brief. The Q2 retrospectives landed and resolved the year's central question: Microsoft measured Tycoon2FA-linked phishing down 92% after the March takedown, while Cisco Talos recorded phishing in over half of all incident-response engagements and authentication abuse in 65%. Aggregate volume fell as successful intrusion rose. Includes a scorecard against every forecast this series has published, including the one we got wrong.
- 01Tycoon2FA-linked phishing fell to 1.2M messages in June — a 92% reduction, roughly 8% of its 15.1M monthly H2 2025 baseline
- 02Cisco Talos recorded phishing in over half of Q2 incident-response engagements, up from a third, with authentication abuse in 65% against 35% in Q1
- 03Ransomware reached a 2026 high of 811 victims across 66 groups, with TheGentlemen and Qilin tied at 119 each
- 04ChatGPT entered the ten most-impersonated brands for the first time; Microsoft led at 22.6%, LinkedIn second at 11.6%
- 05vSpam.org corpus recorded IP-layer malware distribution appearing from zero to 1,538 indicators, below the reach of DNS and registrar controls
June 2026 monthly research brief, focused on disruption. Operation Endgame removed 326 servers and 142 domains supporting SocGholish, Amadey and StealC, recovering 27 million stolen credentials, while Europol dismantled a laundering service that had washed €336M since 2021. Ransomware nevertheless rose 9.4%, leadership changed hands after five months, and an unseen group debuted at number two. The issue examines what disruption actually buys.
Operation Endgame seized 326 servers and 142 domains, recovered ~27 million credentials and restrained €41M in criminal assets
Findings that cite an external source name it. Findings from our own dataset say so and state the sample size. Where a previous forecast was wrong, the follow-up brief says which one and why.
All publications
Newest firstThe monthly brief covers the preceding calendar month and is published mid-month. Every numeric claim is attributed to a primary or secondary public source, or to the vspam.org collector corpus. For questions about methodology or data access, contact research@vspam.org.