Microsoft Threat Intelligence detected about 7.3 billion email-based phishing threats between July and September, with September alone near 3 billion, up 41% from August, according to its Q3 2026 email threat report.

The report, published on 5 November, says the rise did not extend to the techniques that drove activity earlier in the year. QR code phishing stayed far below its early-year peak, at about 12.1 million attacks in the quarter, down 67% from Q2. CAPTCHA-gated phishing turned around after several months of decline and reached 3.1 million attacks in September, nearly twice July’s low. Microsoft ties part of that recovery to SVG attachments, which made up 65% of CAPTCHA-gated attacks in August and 49% in September.

Why it matters

The finding that matters most for administrators concerns exceptions. Microsoft detected about 129 million malicious messages that spoofed the sender domains of tracked business services, such as document-signing and survey tools, at roughly 41 to 46 million a month since May. In September, tenant-level or user-level overrides applied to 63% of those messages that had a recorded security outcome, even though the messages failed authentication checks and were identified as malicious. Microsoft says the figures do not show that recipients opened the messages or that accounts were compromised, but that exception policies deserve attention next to detection coverage.

Microsoft also reports that 94% to 96% of payload-based attacks in the quarter sent recipients to a phishing site or showed a fake sign-in page locally, so an attachment did not need to install software to put an account at risk.

What to do

In our reading, the practical step is an exceptions audit. List every allow rule and bypass that covers a business-service sender domain, check whether it is tied to an authenticated sender, and remove the ones that cover a whole domain. Earlier CyberTech coverage of Bolster AI data on scams passing phishing and of attackers targeting stored credentials points the same way, since a valid login is the goal.

Source: Microsoft Security Blog, Email threat landscape: Q3 2026 trends and insights