Microsoft Logged 7.3 Billion Phishing Emails in Q3 2026
Microsoft Threat Intelligence counted about 7.3 billion email phishing threats from July to September 2026, with September up 41% on August.
Featured photo: Microsoft’s campus in Redmond, Washington (file photo). Photo: Runner1928, Wikimedia Commons, CC BY-SA 4.0.
Microsoft Threat Intelligence said it detected about 7.3 billion email-based phishing threats from July through September 2026, including nearly 3 billion in September alone, up 41% from August, in a report published Nov. 5.
The company said the rise did not come from the techniques that drove attacks earlier in the year. QR code phishing stayed far below its early-2026 peak, while CAPTCHA-gated phishing came back.
Spoofed business services
Microsoft said it detected about 129 million malicious messages that spoofed the real sender domains of business services it tracks, such as e-signature and survey platforms. DocuSign was the most spoofed brand in September, at 29% of that month’s total, it said.
Many of those messages were delivered because organization- or user-set exceptions overrode protections, even after the messages failed authentication and were flagged as malicious. In September, overrides applied to 63% of messages with a recorded security outcome, Microsoft said. It added that the figures do not show that recipients opened the messages or that accounts were compromised.
QR codes down, CAPTCHAs back
QR code phishing fell to about 12.1 million attacks in the quarter, down 67% from the second quarter, and monthly volume ended 86% below its March peak, Microsoft said. CAPTCHA-gated attacks reached 3.1 million in September, helped by renewed use of SVG attachments.
The report said a phishing-as-a-service platform, Tycoon2FA, was still feeling the effects of its disruption in March: about 21,000 linked messages in July, down 99.8% from 8.9 million in February.
Two campaigns
Microsoft described an August campaign against legal organizations that used personalized salary review documents and QR codes to lead targets into device code phishing. In September, purchase order and payroll lures used disguised archives to deliver Agent Tesla, malware used to steal credentials, it said.
In Microsoft Teams, attackers increasingly used ordinary personal names rather than help desk identities while still relying on live conversations, the company said.
What it means
Analysis: The most actionable finding is not the volume but the overrides: security exceptions built for real business workflows let flagged spoofs through. Defenders can check that against their own tenant settings, while the Tycoon2FA numbers show takedowns of phishing kits can have a lasting effect.
Sources
Related coverage
- Censys Finds Hundreds of Exposed ARTEX AI Attack Consoles
- Google Dismantles XCPE Botnet in 1.3 Million TV Boxes
- CISA Adds Exploited SonicWall VPN MFA Bypass to Its KEV List
