Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
Email threat landscape: Q2 2026 trends and insights
Excerpt
In this article Tycoon2FA Q2 disruption impact QR code phishing attacks CAPTCHA-gated phishing tactics Malicious payloads Business email compromise Microsoft Teams threats Notable phishing campaigns Mitigation and protection guidance Indicators of compromise (IOCs) The second quarter of 2026 (April–June) was largely defined by the continuing downstream effects following Microsoft’s Digital Crimes Unit-led disruption efforts against the Tycoon2FA phishing-as-a-service (PhaaS)…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →26 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| me@j-gmails.com | High | Score 58/100 | First seen | |
| mail@ilyff.com | High | Score 58/100 | First seen | |
| contact@ecajovna.sk | High | Score 58/100 | First seen | |
| documentviewer@na.businesshellosign.de | High | Score 61/100 | First seen | |
| Domain | ilyff.com | High | Score 58/100 | First seen |
| Domain | harteprn.com | High | Score 61/100 | First seen |
| m365premiumcommunications@cocinternal.com | High | Score 61/100 | First seen | |
| Domain | 9i6pokerdepot.com | High | Score 63/100 | First seen |
| Domain | cocinternal.com | High | Score 61/100 | First seen |
| Domain | compliance-protectionoutlook.de | High | Score 61/100 | First seen |
| Domain | j-gmails.com | High | Score 58/100 | First seen |
| SHA256 | 5db1ecbbb2c90c51d81bda138d4300b90ea5eb2885cce1bd921d692214aecbc6 | Medium | Score 55/100 | First seen |
| URL | https://t90141296286.p.clickup-attachments.com/t90141296286/fb39c3a9-3161-40ad-847b-0683e0409d6f/Financial_report.bat | High | Score 58/100 | First seen |
| Domain | ecajovna.sk | High | Score 58/100 | First seen |
| nationalintegrity@harteprn.com | High | Score 61/100 | First seen | |
| Domain | acceptable-use-policy-calendly.de | High | Score 61/100 | First seen |
| URL | https://pixeldrain.com/api/file/3v92oJiL | High | Score 58/100 | First seen |
| SHA256 | b5a3346082ac566b4494e6175f1cd9873b64abe6c902db49bd4e8088876c9ead | Medium | Score 55/100 | First seen |
| nationaladmin@gadellinet.com | High | Score 61/100 | First seen | |
| cocpostmaster@cocinternal.cm | High | Score 58/100 | First seen | |
| Domain | gadellinet.com | High | Score 61/100 | First seen |
| me@x2mails.com | High | Score 58/100 | First seen | |
| Domain | clickup-attachments.com | High | Score 58/100 | First seen |
| Domain | x2mails.com | High | Score 58/100 | First seen |
| SHA256 | 11420d6d693bf8b19195e6b98fedd03b9bcbc770b6988bc64cb788bfabe1a49d | Medium | Score 55/100 | First seen |
| customer.service@9i6pokerdepot.com | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…