Email threat landscape: Q3 2026 trends and insights

Phishing threats from email increased significantly across the third quarter, with approximately 7.3 billion threats detected from July through September, including a 41% rise to nearly 3 billion in September alone. Attackers targeted sender identity by spoofing business service domains, with 129 million malicious messages spoofing these domains during Q3. Security exceptions applied at the tenant or user level often allowed malicious messages to bypass security protections after failing authentication checks.
QR code phishing activity decreased substantially across Q3, falling 67% from Q2, with monthly volumes remaining well below earlier peaks despite an increase in other email threats. Delivery methods shifted; while PDF and DOC/DOCX attachments were common delivery formats for QR code attacks, SVG attachments saw a significant recovery as a primary delivery method for CAPTCHA-gated phishing, increasing sixfold in August before settling at 49% of attacks in September.
Malicious attachment payloads overwhelmingly focused on credential theft rather than malware installation, with HTML and PDF files being the most common carriers for these threats. The use of SVG files increased, correlating with the recovery in CAPTCHA-gated phishing, indicating a shift in attacker focus toward exploiting visual elements alongside established social engineering lures like familiar business requests for financial actions.
Business contact impersonation (BCI) volume declined across Q3, totaling 6.2 million attacks, although explicit financial requests like invoice payments saw a significant recovery in volume between June and September. Teams-based threats involved malicious call attempts, with attackers increasingly using personal names instead of explicit help desk identities to facilitate social engineering.

* Microsoft detected approximately 7.3 billion email-based phishing threats from July through September.
* The number of email-based phishing threats increased to nearly 3 billion in September, up 41% from August.
* Approximately 129 million malicious messages spoofed the sender domains of tracked business services during Q3.
* Many malicious messages were delivered because organization- or user-configured exceptions overrode security protections.
* In Microsoft Teams, attackers increasingly used ordinary personal names rather than explicit help desk identities in live interactions.
* Credential theft remained the dominant objective across malicious attachment activity in Q3.
* QR code phishing detected 12.1 million attacks over the quarter, a 67% decrease from Q2.
* SVG attachment volume increased sixfold in August, accounting for almost half of September’s total CAPTCHA-gated phishing attacks.
* HTML attachments accounted for nearly two-thirds of malicious payloads during Q3.
* BCI volume totaled approximately 6.2 million attacks across Q3.
* A campaign targeting legal organizations used a QR code in a Word document to lead recipients into device code phishing.
* A campaign involving purchase orders and payroll lures delivered Agent Tesla malware via disguised archives (.pdf.uu and .xml.001).

The pattern emerging is the exploitation of context and exception management as primary vectors for successful compromise, rather than purely technical evasion. Attackers are demonstrating adaptability by mixing familiar lures (salary reviews, purchase orders) with evolving delivery mechanisms (QR codes, SVG attachments) to maximize efficacy across different organizational contexts. The success of business contact impersonation hinges on exploiting the inherent trust placed in established workflows, which is then undermined when broad security exceptions are in place; this suggests that the administrative control layer is as critical as perimeter defenses.
The shift in attachment tactics—the rise of SVG files alongside the decline of DOCX usage—points to an evolving delivery methodology that prioritizes visual exploits over traditional document-based malware distribution, especially when layered with CAPTCHA mechanisms. The fact that attackers use same infrastructure and payloads across distinct lures (QR code phishing vs. Agent Tesla delivery) indicates a modular operational playbook designed for high flexibility, suggesting that the malicious goal (credential theft) dictates the payload more than the initial pretext.
The persistence of credential theft as the dominant payload objective, despite evolving attachment types, reinforces the fundamental vulnerability: the endpoint security and identity controls must assume risk across all potential attack paths, not just those explicitly monitored by traditional signature matching. The narrative suggests that organizational friction—the need to maintain operational fluidity through exceptions—directly creates exploitable gaps when faced with sophisticated social engineering layered onto legitimate business processes.
Bridge Questions: If organizations could eliminate the reliance on broad security exceptions for standard workflows, how would this change the observed spoofing volume? What are the systemic costs associated with maintaining a high degree of "operational flexibility" versus absolute security in enterprise environments? What alternative methods exist to verify sender identity that do not rely solely on domain authenticity when business processes demand speed?