In Q3 2026, Microsoft Threat Intelligence reported a staggering 7.3 billion email-based phishing threats, with a notable spike to nearly 3 billion in September alone, marking a 41% increase from August. This surge highlights a shift in phishing tactics, as traditional methods like QR code phishing have significantly declined, while CAPTCHA-gated phishing has seen a resurgence, driven by the use of SVG attachments.
Phishing Trends and Techniques
The quarter revealed that sender identity and security exceptions play a crucial role in the effectiveness of phishing attacks. Microsoft identified approximately 129 million malicious messages that spoofed the domains of legitimate business services. Alarmingly, many of these messages bypassed security protections due to user-configured exceptions, even after failing authentication checks. This indicates that overly broad exceptions, intended to facilitate legitimate workflows, can inadvertently expose organizations to impersonation attacks.
Two notable phishing campaigns exemplified the evolving tactics used by threat actors. One campaign in August targeted legal organizations with personalized salary review documents and QR codes, despite a general decline in QR code phishing. In September, another campaign utilized purchase order and payroll lures to deliver Agent Tesla malware, which is commonly employed for credential theft. These campaigns underscore the continued effectiveness of familiar business requests as lures for phishing attacks.
Impact of Tycoon2FA Disruption
The disruption of the Tycoon2FA phishing-as-a-service platform in March 2026 had a lasting impact, with Microsoft detecting a dramatic drop in phishing messages linked to the platform—from 8.9 million in February to approximately 21,000 by July, a decrease of 99.8%. This disruption illustrates the potential effectiveness of targeted law enforcement actions against phishing infrastructure.
CAPTCHA-Gated Phishing and Malicious Payloads
While QR code phishing attacks saw a significant decline, CAPTCHA-gated phishing began to recover, with Microsoft detecting 3.1 million such attacks in September, nearly double the volume from July. The resurgence was largely attributed to the increased use of SVG attachments, which accounted for a substantial portion of these attacks.
Credential theft remained the primary objective of malicious payloads, with 94-96% of attacks directing recipients to phishing sites or presenting fraudulent sign-in pages. HTML and PDF attachments were the most common payload types, together comprising over half of the attacks. The return of SVG files as a delivery method further complicates the threat landscape, as they can evade traditional email scanning controls.
Defensive Recommendations
To mitigate the risks associated with these evolving phishing threats, Microsoft recommends several strategies. Organizations should review their security exception policies to ensure they do not inadvertently weaken protections against impersonation. Additionally, user awareness training and phishing simulations can help prepare employees to recognize and respond to phishing attempts effectively. Implementing advanced security measures, such as Zero-hour auto purge and enabling Safe Links and Safe Attachments in Microsoft Defender for Office 365, can further enhance defenses against these threats.
As phishing tactics continue to evolve, organizations must remain vigilant and adapt their security strategies to protect against increasingly sophisticated threats. For further insights, Microsoft provides detailed recommendations and threat intelligence resources to assist organizations in strengthening their defenses.
For more information on the email threat landscape, refer to the Microsoft Security Blog.
