Phishing Threats Reached 7.3 Billion in Q3 2026
Microsoft Threat Intelligence detected roughly 7.3 billion e-mail-based phishing threats in the third quarter of 2026, including a 41% increase from August to September.
According to a report from Microsoft Threat Intelligence and the Microsoft Defender Security Research Team, phishing detections reached nearly 3 billion in September alone.
The findings also highlighted changes in attacker techniques, including business-service impersonation, credential theft, and social engineering through Microsoft Teams.
Security Overrides Allow Malicious Messages Through
The Redmond-based firm recognized approximately 129 million malicious messages spoofing the sender domains of tracked business services during Q3.
DocuSign was the most frequently spoofed brand in September, accounting for 29% of the month's tracked spoofing activity. Adobe, SurveyMonkey, and Barracuda also experienced increases toward the end of the quarter.
The research found that some malicious messages were delivered despite failing e-mail authentication checks and being identified as threats.
In September, tenant- or user-level security overrides applied to 63% of these messages with a recorded security outcome — most involved tenant-level exceptions.
Microsoft warned that overly broad exceptions intended to support legitimate business communications can weaken protection against impersonation attacks.
The company emphasized that these findings do not establish whether recipients opened the messages or whether accounts were compromised.
Teams Impersonation and Credential Theft Continue
Microsoft also recorded approximately 141,000 malicious Teams call attempts during Q3.
Attackers increasingly used ordinary personal names instead of explicitly impersonating IT support personnel. Such display names accounted for 46% of an observed sample in July, rising to 88% in September.
Meanwhile, QR code phishing declined 67% compared to Q2, totaling roughly 12.1 million attacks.
CAPTCHA-gated phishing activity increased toward the end of the quarter, reaching 3.1 million detected attacks in September. SVG attachments played a significant role in the increase.
Credential theft remained the primary objective of malicious attachment campaigns, with approximately 94% to 96% of payload-based attacks directing users to phishing sites or fraudulent sign-in pages.
Microsoft recommended reviewing Exchange Online Protection and Defender for Office 365 configurations, enabling Safe Links and Safe Attachments, and strengthening authentication protections.
The company also advised organizations to review security exceptions and verify the identities of external Teams contacts before responding to suspicious requests.
For more information, read the Microsoft blog post.