Loading story…
Threat actors have significantly increased abuse of the Axios HTTP client and Microsoft's Direct Send feature to deliver highly effective phishing campaigns. Axios-powered attacks surged 241% from June to August 2025, achieving up to a 70% success rate when combined with Direct Send. These campaigns use compensation-themed lures and QR codes to harvest credentials and bypass MFA, blending malicious activity with legitimate traffic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported detecting **7.6 billion** email-based phishing threats in Q2 2026, with credential theft driving **94% to 96%** of malicious payload activity. The company said its March disruption of the **Tycoon2FA** phishing-as-a-service platform cut message volume tied to that operation by **92%** from pre-disruption levels, while QR-code phishing and CAPTCHA-gated phishing also declined. A short-lived April rise in business email compromise was attributed to a small number of high-volume campaigns rather than a sustained surge. Attackers increasingly shifted to **Microsoft Teams** for social engineering, particularly vishing and fake IT-support interactions that abused remote-access tools such as **Quick Assist**; weekly malicious call attempts rose roughly **80%** since the start of 2026 and reached nearly **10 times** the mid-2025 baseline by late June. Microsoft also described a June automated BEC campaign that hit more than **67,000 users** across **42,000 organizations** in under three hours, along with a multi-stage phishing operation that used nested **EML** files, **ICS** invitations, Microsoft OAuth redirection, and a **BAT** dropper to deliver malware.
Aug 18, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
Attackers are abusing Microsoft Exchange Online's **Direct Send** feature to deliver phishing emails that appear to come from trusted internal users, without needing authentication. The campaign has targeted more than 70 organizations, primarily in the United States, since May 2025. By using an organization's predictable smart host address and a recipient address, attackers can send messages through Microsoft's infrastructure with tools such as PowerShell, causing spoofed emails to look like legitimate internal mail and helping them evade many sender-authenticity checks, including **SPF** and **DMARC**. The activity affects Microsoft 365 recipients and can also mislead third-party security products into treating forged messages as trusted internal traffic. Defenders are being urged to enable **Reject Direct Send** in Exchange Online, enforce stricter DMARC and SPF policies, deploy anti-spoofing rules, quarantine unauthenticated messages that appear internal, and monitor Direct Send traffic for suspicious headers, routing patterns, and behavioral anomalies. Organizations are also advised to enable **MFA** to reduce the impact of successful phishing attempts.
Jun 29, 2026