Microsoft: 7.3 billion phishing threats in Q3 2026, with a 41% jump in September

The Microsoft Threat Intelligence team recorded about 7.3 billion phishing threats (scams that try to extract passwords and data with fake messages) from July to September 2026. The third quarter closed with a sharp rise: in September almost 3 billion threats were detected, 41% more than in August. The company published on Thursday, November 5 its quarterly report on the email threat landscape.

The increase did not involve the techniques that dominated at the start of the year. QR-code attacks reached 12.1 million, 67% fewer than in the second quarter, and in September their monthly volume was 86% lower than the March peak. By contrast, attacks using fake pages behind a CAPTCHA check recovered after months of decline and reached 3.1 million in September, almost double the July low.

SVG attachments (vector-image files that can hide code) played a key role. In CAPTCHA attacks they accounted for 65% in August, up from 17% in July, and 49% in September. Across all malicious attachments they reached 10.1 million in August, the highest monthly volume in more than a year. HTML and PDF remained the most common formats, while DOC/DOCX fell below 3% in September. Between 94% and 96% of attachment-based attacks led to a phishing page or a fake sign-in screen rather than to software installation.

Brand abuse, Teams and two campaigns

Microsoft also detected about 129 million malicious messages that appeared to come from the real domain of well-known business services. In September DocuSign was the most frequently spoofed name, with 29% of the month’s total. Many messages reached recipients even though they failed authentication checks and were judged malicious, because exceptions set by organisations or users overrode the protection. In September exceptions applied to 63% of messages with a recorded outcome.

In Microsoft Teams about 141,000 malicious call attempts were recorded, peaking in July and falling 31% by September. The attackers increasingly avoided display names that explicitly said technical support: ordinary personal names rose from 46% to 88% of the sample, while explicit “help desk” identities fell from 17% to 2%.

Microsoft describes two campaigns. On Wednesday, August 19, a message titled “Salary Review” was sent to more than 10,000 users in over 4,800 organisations, almost all in the US, aimed mainly at law firms. The QR code in the attached Word file led to a fake OneDrive sign-in page that tried to capture the login through device code phishing: the user types a code into Microsoft’s legitimate sign-in page, signs in, and the attacker obtains a valid session token without ever learning the password and without a new multi-factor authentication (MFA) check.

On Monday, September 21, a Spanish-language campaign using a purchase-order (63%) or payroll (37%) lure targeted more than 56,000 users in over 8,100 organisations, mostly in Spanish-speaking countries, led by Colombia (15%), followed by the US and Mexico (12% each). Compressed files disguised as documents led to the Agent Tesla malware, which collects passwords and other data from the infected device.

The Tycoon2FA takedown and the recommendations

The March takedown of the Tycoon2FA platform, which sold phishing as a service, continues to have an effect: in July about 21,000 related messages were detected, 99.8% fewer than the 8.9 million of February. Microsoft recommends, among other things, reviewing security exceptions, enabling Safe Links and Safe Attachments, and passwordless authentication. See also our report on the analysis of 383,000 vulnerabilities by Microsoft.