Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
3 IOCs

Email threat landscape: Q1 2026 trends and insights

Microsoft Threat Intelligence
Microsoft Threat Intelligence
Published April 30, 2026Original Report

Excerpt

In this article Tycoon2FA disruption impact QR code phishing attacks CAPTCHA tactics Malicious payloads Business email compromise Defending against email threats Microsoft Defender detections During the first quarter of 2026 (January-March), Microsoft Threat Intelligence detected approximately 8.3 billion email-based phishing threats, with monthly volumes declining slightly from 2.9 billion in January to 2.6 billion in March. By the end of the quarter, QR code phishing…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREbouleversement.niovap…haematogenesis.hvisha…ubiquitarianism.drilt…CAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(3)
Capability
Victim

Attack Flow7 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1566
1/7
Phishing
ActionSend phishing emails
Threat actors send a large volume of email-based phishing threats, including QR code phishing and CAPTCHA-gated phishing.

Indicators of Compromise

Open the mindmap →

3 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainbouleversement.niovapahrm.comHighScore 58/100First seen
Domainhaematogenesis.hvishay.comHighScore 58/100First seen
Domainubiquitarianism.drilto.comHighScore 58/100First seen

IOC Relationship Graph

Building graph…