Microsoft Threat Intelligence reported a significant surge in email-based phishing threats during Q3 2026, detecting approximately 7.3 billion threats from July through September. The spike peaked in September with nearly 3 billion threats, a 41% increase from August. However, not all phishing techniques saw a rise; QR code phishing remained low, while CAPTCHA-gated phishing reversed its decline, partly due to a resurgence in SVG attachments.
The quarter also highlighted how sender identity and security exceptions can impact threat outcomes. Microsoft identified around 129 million malicious messages spoofing business service domains, many of which were delivered due to organization- or user-configured exceptions overriding security protections. In Microsoft Teams, attackers increasingly used personal names for social engineering, while credential theft remained the primary goal across malicious attachment activity.
Two notable campaigns illustrated these trends. An August campaign targeted legal organizations with personalized salary review documents and QR codes leading to device code phishing. In September, attackers used disguised archives to deliver Agent Tesla malware through purchase order and payroll lures. These campaigns demonstrated how familiar business requests continue to be effective lures.
The effects of the March disruption of the Tycoon2FA phishing-as-a-service platform were still evident. By July, Microsoft detected only about 21,000 phishing messages linked to the platform, down 99.8% from 8.9 million in February. The blog provided insights into email threat activity, including shifts in phishing techniques, malicious payloads, business contact impersonation, and Teams-based threats.