Microsoft reports 7.3 billion email phishing threats in Q3 2026
Original title: Email threat landscape: Q3 2026 trends and insights
The report shows QR code phishing dropped 67% but business service spoofing hit 129 million messages with tenant exceptions weakening protections.
Microsoft Threat Intelligence detected 7.3 billion email-based phishing threats from July to September 2026, with September volume rising 41% to nearly 3 billion. Spoofed sender domains of tracked business services accounted for 129 million malicious messages, many passing through tenant-level security exceptions. QR code phishing fell far below early-year peaks while credential theft remained the main malware objective, as seen in campaigns using Agent Tesla.
- 129 million spoofed business-service sender domain messages detected
- QR code phishing volume down 67% from Q2
- Tycoon2FA PHaaS platform disruption caused 99.8% drop in linked phishing
- PDF attachments remained the dominant QR code delivery format
- Personal name impersonation used in Teams social engineering
- Vendors
- Microsoft
- Malware
- Agent Tesla
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | carloxmextos.org | 7%. Both variations were sent from the address contacto06[@]carloxmextos[.]org . Sender Policy Framework (SPF), DomainKeys Identified Ma |
| domain | splace.co.za | ng a Microsoft OneDrive sign-in portal hosted on the domain splace[.]co[.]za . The page presented an alphanumeric code and instructe |
| domain | wekash.net | were sent with the subject line “Salary Review” from smtp[@]wekash[.]net via Amazon Simple Email Service. The email body carried n |
From the original article
13 min read at microsoft.com
Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security overrides.
By Microsoft Threat Intelligence and Microsoft Defender Security Research Team · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.