Phishing Surges to 3 Billion Monthly Detections as Broad Email Exceptions Enable Bypass
Written by AI from the linked story. Not reviewed by an editor. How this works
In Q3 2026, email-based phishing attacks surged 41% month-over-month, with attackers exploiting overly broad security exceptions that allowed malicious messages to bypass email filtering controls. Threat actors spoofed legitimate business service domains and used familiar social engineering lures — such as salary reviews and purchase orders — to harvest credentials and deliver malware like Agent Tesla. The resurgence of CAPTCHA-gated phishing highlights that attackers continuously adapt techniques to evade automated defences. This matters because credential theft at this scale provides adversaries with persistent access to corporate environments, enabling downstream attacks including ransomware, data exfiltration, and business email compromise.
Tactical Insight
Immediate actions
- Audit and tighten all email security exceptions, removing any broad allow-list entries that permit spoofed or unverified business-service domains.
- Enable DMARC, DKIM, and SPF enforcement for all inbound and outbound mail flows to reject domain-spoofed messages at the gateway.
Long-term improvements
- Deploy multi-factor authentication (MFA) across all user accounts so that stolen credentials alone cannot grant attacker access.
- Establish a regular phishing simulation and security awareness training programme targeting lures specific to current threat trends (e.g., salary reviews, purchase orders).
- Implement Zero Trust email access policies that evaluate message context, sender reputation, and link/attachment risk dynamically rather than relying on static exceptions.
Detection measures
- Configure SIEM or email security platforms to alert on anomalous spikes in inbound message volume or new CAPTCHA-redirect URL patterns.
- Integrate threat intelligence feeds covering newly registered or spoofed business-service domains to block emerging phishing infrastructure proactively.