Email threat landscape: Q3 2026 trends and insights
Microsoft reports a 41% surge in email phishing in September 2026, with credential theft as a primary goal.
Microsoft Threat Intelligence observed a significant increase in email-based phishing threats in Q3 2026, with nearly 3 billion detected in September alone, a 41% rise from August. While QR code phishing declined, CAPTCHA-gated phishing saw a resurgence. Attackers increasingly spoofed business service domains, with many malicious messages bypassing security due to broad exceptions. Credential theft remained the dominant objective, with campaigns using familiar lures like salary reviews and purchase orders to deliver malware such as Agent Tesla.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIn Q3 2026, email-based phishing attacks surged 41% month-over-month, with attackers exploiting overly broad security exceptions that allowed malicious messages to bypass email filtering controls. Threat actors spoofed legitimate business service domains and used familiar social engineering lures — such as salary reviews and purchase orders — to harvest credentials and deliver malware like Agent Tesla. The resurgence of CAPTCHA-gated phishing highlights that attackers continuously adapt techniques to evade automated defences. This matters because credential theft at this scale provides adversaries with persistent access to corporate environments, enabling downstream attacks including ransomware, data exfiltration, and business email compromise.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Agent Tesla