[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLBs_C2DdmRcAl0OPkHS-TZ2lamBvXbK9gjV52I4Tkkk":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0e597227-82ec-4356-8856-85c8b125a4ce","Email threat landscape: Q3 2026 trends and insights","email-threat-landscape-q3-2026-trends-and-insights-42dccc","Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security overrides. The post Email threat landscape: Q3 2026 trends and insights appeared first on Microsoft Security Blog.","Microsoft Threat Intelligence observed a significant increase in email-based phishing threats in Q3 2026, with nearly 3 billion detected in September alone, a 41% rise from August. While QR code phishing declined, CAPTCHA-gated phishing saw a resurgence. Attackers increasingly spoofed business service domains, with many malicious messages bypassing security due to broad exceptions. Credential theft remained the dominant objective, with campaigns using familiar lures like salary reviews and purchase orders to deliver malware such as Agent Tesla.","Microsoft reports a 41% surge in email phishing in September 2026, with credential theft as a primary goal.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F05\u002Femail-threat-landscape-q3-2026-trends-and-insights\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FQ3-featured-image.png","2026-11-05T16:00:00+00:00","2026-11-05T18:00:19.230233+00:00",8,[17,20,23,25],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Defender for Office 365","product",{"name":24,"type":22},"Microsoft Defender for Endpoint",{"name":26,"type":27},"Tycoon2FA","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},[42],{"type":38,"value":43,"context":44},"Agent Tesla","Malware used to collect credentials and information, delivered via disguised archives in Q3 2026 campaigns.",[18,21,24],{"controls":47,"vendors":129},[48,76,103],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,68],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":62,"vendor_name":18,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":77,"name":78,"problem":79,"products":80},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":98,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":98,"url":101,"description":102},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":104,"name":105,"problem":106,"products":107},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":125,"product_name":126,"url":127,"description":128},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[130],{"slug":62,"name":18,"logo_path":63,"roles":131},[132],"reported_by",{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"phishing-surges-to-3-billion-monthly-detections-as-broad-email-exceptions-enable-bypass","Phishing Surges to 3 Billion Monthly Detections as Broad Email Exceptions Enable Bypass","In Q3 2026, email-based phishing attacks surged 41% month-over-month, with attackers exploiting overly broad security exceptions that allowed malicious messages to bypass email filtering controls. Threat actors spoofed legitimate business service domains and used familiar social engineering lures — such as salary reviews and purchase orders — to harvest credentials and deliver malware like Agent Tesla. The resurgence of CAPTCHA-gated phishing highlights that attackers continuously adapt techniques to evade automated defences. This matters because credential theft at this scale provides adversaries with persistent access to corporate environments, enabling downstream attacks including ransomware, data exfiltration, and business email compromise.",[138,139,140,141,142,143,144],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32",{"GDPR Article 32":146,"MITRE ATT&CK T1566: Phishing":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"CIS Control 17: Incident Response Management":149,"CIS Control 14: Security Awareness and Skills Training":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"Mass credential harvesting directly threatens personal data confidentiality; Article 32 requires organisations to implement appropriate technical measures — including effective email security controls — to protect personal data against foreseeable threats like phishing.","This technique directly describes the attack vector observed — adversaries sent spear-phishing emails with malicious lures to steal credentials and deliver Agent Tesla, making T1566 the foundational reference for detection and mitigation of this campaign.","Broad email security exceptions represent a misconfiguration flaw that allowed malicious mail to bypass controls; a formal remediation process requiring regular review and justification of exceptions would have closed this gap.","A 41% surge in phishing volume requires a prepared incident response capability to rapidly triage compromised accounts, revoke stolen credentials, and contain malware like Agent Tesla before it establishes persistence.","Users who receive salary-review and purchase-order lures are the last line of defence; structured, role-based phishing awareness training would reduce click rates and credential submission against these well-known social engineering themes.","The permissive email gateway exceptions constitute a known technical weakness; ISO 27001 requires organisations to identify, evaluate, and remediate such vulnerabilities on a timely basis to prevent exploitation.","Because credential theft was the dominant objective, enforcing MFA and strong identity controls under PR.AA would ensure that even successfully phished passwords cannot be weaponised for initial access."]