Microsoft Threat Intelligence detected 8.3 billion phishing threats in Q1 2026, with QR code attacks up 146% and CAPTCHA-gated phishing surging 125% in March alone, both techniques engineered to bypass automated security controls. Credential harvesting now accounts for 94% of payload-based attacks, signaling a deliberate shift by threat actors away from malware and toward identity theft as the primary entry point. A law enforcement disruption of the Tycoon2FA phishing-as-a-service platform produced only temporary relief, consistent with a broader pattern of PhaaS operators hardening their infrastructure against takedowns.