VIPRE’s Email Threat Trends Report: Q2 2026

When the Tech Gets Smarter, Attackers Target the Human

In Q2 2026, attackers found new ways around increasingly sophisticated email defenses.

They abused legitimate Microsoft OAuth requests. They hid malicious destinations behind trusted infrastructure. They impersonated executives and familiar brands. And in business email compromise attacks, they increasingly relied on conversation and social engineering rather than obviously malicious links and attachments.

This report shows how email threats in Q2 tricked users, how attackers are finding ways around traditional defenses, and what organizations need to watch.

The common thread? Today’s email threats don’t always look malicious.

VIPRE analyzed 1.22 billion emails to uncover how these tactics are evolving, what attackers are doing differently, and why modern email security needs to understand context, behavior, and intent to stay ahead.