Microsoft reports 7.3 billion email phishing threats in Q3 2026 with spoofed business domains rising
PHISHINGMicrosoftredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Microsoft Threat Intelligence logged about 7.3 billion email phishing threats from July to September 2026, with nearly 3 billion in September alone, up 41% from August. Around 129 million malicious messages spoofed the sender domains of tracked business services, and overrides applied to 63% of messages with a recorded security outcome in September. QR code phishing fell 67% from Q2, while CAPTCHA-gated phishing rose again, partly through SVG attachments.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review tenant and user-level email security exceptions that override protections for failed or malicious messages.
- Treat unexpected document-signing, invoice, payroll and survey requests with caution, even when the branding looks familiar.
- Be wary of QR codes in emails and attachments, and check the sender through a separate channel before acting.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Microsoft Security Blog
Who and what is in it
Companies