Microsoft details email phishing trends and campaigns in Q3 2026

Summary

Microsoft detected 7.3 billion email phishing threats in Q3 2026. QR-code phishing fell 67% from Q2, while CAPTCHA-gated attacks rebounded. The report details impersonation trends, campaigns, defenses, detections, and hunting queries.

Key points

Microsoft detected about 7.3 billion email phishing threats from July through September; September volume approached 3 billion, up 41% from August.
About 129 million malicious messages spoofed tracked business-service sender domains. In September, tenant- or user-level overrides applied to 63% of messages with a recorded security outcome; the figures do not establish that recipients opened them or accounts were compromised.
QR-code phishing totaled about 12.1 million attacks, down 67% from Q2. CAPTCHA-gated phishing rebounded to 3.1 million attacks in September, with SVG attachments a leading delivery method.
Credential theft remained the dominant objective: 94–96% of payload-based attacks directed recipients to phishing sites or presented fraudulent sign-in pages rather than installing malware.
An August campaign targeting legal organizations used personalized salary-review documents and QR codes to direct recipients into device-code phishing; completing the sign-in could transfer a session token to attackers.
A September purchase-order and payroll campaign used disguised archives to deliver Agent Tesla, through a JavaScript downloader and PowerShell payload in one branch and a disguised executable in another.
After the March disruption of Tycoon2FA, Microsoft detected about 21,000 linked phishing messages in July, down 99.8% from 8.9 million in February.

Article Details

Publisher: Microsoft Security Blog
Report Period: 2026-07-01 to 2026-09-30
Scope: Microsoft-detected email and collaboration threats, phishing tactics, malicious payloads, impersonation, and campaigns observed in Q3 2026.
Sample Size: Not disclosed
Key Statistics: Microsoft Threat Intelligence detected approximately 7.3 billion email-based phishing threats from July through September 2026; September alone accounted for nearly 3 billion, up 41% from August.
Approximately 129 million malicious messages spoofed tracked business-service sender domains in Q3. In September, overrides applied to 63% of messages with a recorded security outcome; these figures do not establish that recipients opened the messages or that accounts were compromised.
Approximately 12.1 million QR-code phishing attacks were detected in Q3, down 67% from Q2.
Microsoft observed approximately 141,000 malicious Teams call attempts in Q3. The attempts included unanswered, rejected, and short-lived calls and do not establish successful attacker interactions.
The August campaign targeted more than 10,000 users across more than 4,800 organizations; the September campaign targeted more than 56,000 users across more than 8,100 organizations.
Recommendations: Review tenant- and user-level email exceptions to ensure they do not broadly override authentication checks and security protections.
Verify the identity and requests of external Teams contacts, and restrict which users can chat or meet with people outside the organization.
Turn on Safe Links and Safe Attachments in Microsoft Defender for Office 365.
Enable passwordless authentication where supported and use phishing-resistant MFA for privileged accounts.
Enable Zero-hour auto purge (ZAP) and investigate and purge malicious email that was delivered.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`carloxmextos[.]org`	Authenticated sender domain used for both September purchase-order and payroll campaign variations.
DOMAIN	`splace[.]co[.]za`	Domain hosting the attacker-controlled phishing page used in the August device-code phishing campaign.
DOMAIN	`wekash[.]net`	Sender domain used to distribute the August phishing campaign emails.
EMAIL	`contacto06@carloxmextos[.]org`	Sender address used for both observed September campaign variations.
EMAIL	`smtp@wekash[.]net`	Sender address observed in the August campaign messages.
SHA256	`72966b30bbd87e42c683d2ac7a42bb62021fc14389d508551432ffd70d62f33a`	SHA-256 hash of the Agent Tesla executable from the payroll campaign variation.
SHA256	`bedd2297739632da8ee470367295fe976e55be74d628dcaee7fa98121ee530f1`	SHA-256 hash of the purchase-order RAR attachment used in the September campaign.
SHA256	`c438b9a3bb67e2c10eff0d01513422dc17dce7c5508303a680e46f3dcec886ef`	SHA-256 hash of the payroll RAR attachment used in the September campaign.
SHA256	`ce832350c165522db03db040ca07917976d1a91f97e7016ea36dcc6b53e0eb13`	SHA-256 hash of the JavaScript downloader contained in the purchase-order archive.
SHA256	`f8b49891d15a578e4de28fecf99d0d78db6b2c3da81cd51c931b8d128e60c187`	SHA-256 hash of the PowerShell payload associated with Agent Tesla delivery.
URL	`hxxps[:]//splace[.]co[.]za/0987643345678908765421234567890987654320987654321223456787654/onedrive/`	Specific URL identified as hosting phishing content for the August campaign.