Microsoft reports 7.3 billion phishing threats in Q3 2026

Microsoft Threat Intelligence and Defender researchers report a busy Q3 2026 for email and collaboration threats. Across July to September, they detected about 7.3 billion email-based phishing threats, with nearly 3 billion in September alone — up 41% on August. While overall threat volume rose, certain techniques cooled after earlier peaks: QR code phishing remained well below its early‑year high, whereas CAPTCHA‑gated phishing rebounded, driven in part by renewed use of SVG attachments.

The analysis also notes that spoofed sender domains remained a major vector, with around 129 million malicious messages spoofing business‑service domains in Q3. DocuSign was the most frequently spoofed brand in September (about 29% of that month’s spoofed messages); Adobe, SurveyMonkey and Barracuda also rose toward quarter‑end.

A key finding is that many such messages were allowed through by tenant- or user‑level security exceptions, even after failing authentication checks, highlighting how broad overrides can undermine protections intended to preserve legitimate workflows.

Two campaigns illustrate the breadth of activity behind these trends. In August, a salary‑review lure targeting legal organisations used a QR code in a Word document to direct recipients to a device code credential capture page, while in September a Spanish‑language purchase order and payroll campaign delivered Agent Tesla malware via nested archives and a JavaScript downloader.

The purchase‑order path involved a RAR attachment with a .uu extension and a PowerShell payload, and the payroll path used a RAR archive delivering an Agent Tesla executable. Microsoft’s response guidance covers Defender detections, user training, and protective controls across Exchange Online Protection, Defender for Office 365 and Teams, with specific indicators of compromise and hunting queries provided to aid investigations.