Trends in Spam, Phishing, Spoofing, Malware & DNS Abuse

Abstract

July 2026 monthly research brief. The Q2 retrospectives landed and resolved the year's central question: Microsoft measured Tycoon2FA-linked phishing down 92% after the March takedown, while Cisco Talos recorded phishing in over half of all incident-response engagements and authentication abuse in 65%. Aggregate volume fell as successful intrusion rose. Includes a scorecard against every forecast this series has published, including the one we got wrong.

Key Findings

1. 1Tycoon2FA-linked phishing fell to 1.2M messages in June — a 92% reduction, roughly 8% of its 15.1M monthly H2 2025 baseline
2. 2Cisco Talos recorded phishing in over half of Q2 incident-response engagements, up from a third, with authentication abuse in 65% against 35% in Q1
3. 3Ransomware reached a 2026 high of 811 victims across 66 groups, with TheGentlemen and Qilin tied at 119 each
4. 4ChatGPT entered the ten most-impersonated brands for the first time; Microsoft led at 22.6%, LinkedIn second at 11.6%
5. 5vSpam.org corpus recorded IP-layer malware distribution appearing from zero to 1,538 indicators, below the reach of DNS and registrar controls

Topics