Microsoft reports 7.3 billion email phishing threats in Q3 2026 with spoofed business domains rising
- Severity
- Medium
- Sources
- 1
What happened
Microsoft's Q3 2026 review reports about 7.3 billion email phishing threats, with roughly 3 billion in September, and about 129 million messages spoofing tracked business-service sender domains, with DocuSign the most spoofed brand in September at 29%. Many spoofed messages failed authentication yet were delivered under tenant- or user-level overrides, which applied to 63% of messages with a recorded outcome in September. QR code phishing fell to about 12.1 million attacks, and the Tycoon2FA PhaaS platform's volume dropped 99.8% after a March disruption. Defenders should audit exception policies, enforce authentication checks on business-service senders, and hunt using the queries Microsoft published.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review tenant and user-level email security exceptions that override protections for failed or malicious messages.
- Treat unexpected document-signing, invoice, payroll and survey requests with caution, even when the branding looks familiar.
- Be wary of QR codes in emails and attachments, and check the sender through a separate channel before acting.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies