Email Threat Landscape Q3 2026: Key Microsoft Trends

Introduction

Microsoft’s Q3 2026 threat intelligence report highlights how quickly phishing tactics can shift, even when overall email threat volume surges. For IT administrators, the key takeaway is that strong detection alone is not enough if policy exceptions, collaboration tools, or familiar business workflows create gaps attackers can exploit.

What’s new in Q3 2026

Email threat volume surged

• Microsoft detected about 7.3 billion email-based phishing threats from July through September 2026.
• September alone accounted for nearly 3 billion threats, a 41% increase from August.

Spoofed business sender domains remained a major risk

• Microsoft identified around 129 million malicious messages spoofing trusted business service domains.
• DocuSign was the most spoofed brand in September, representing 29% of that month’s total.
• A major concern was that many of these messages were still delivered because tenant or user-level exceptions overrode protections.

QR code phishing declined, but did not disappear

• QR phishing dropped to 12.1 million attacks in Q3, down 67% from Q2.
• PDF attachments remained the most common delivery method, while embedded QR codes in email bodies increased by the end of the quarter.

CAPTCHA-gated phishing rebounded

• By September, Microsoft detected 3.1 million CAPTCHA-gated attacks, nearly double July levels.
• SVG attachments played a major role in the recovery of this tactic.

Teams-based social engineering evolved

• Attackers increasingly used ordinary personal names instead of obvious help desk identities in Microsoft Teams.
• Live interaction remained central to convincing users to trust malicious requests.

Why this matters for IT admins

The report shows that phishing campaigns continue to rely on familiar business processes such as invoices, surveys, payroll, and document signing. That makes user trust in well-known brands and routine workflows a key attack surface.

Just as important, Microsoft’s findings suggest that security exceptions may be undermining protection. Messages that fail authentication and are identified as malicious can still reach users when broad allow rules are in place. This is especially relevant for organizations that have created exceptions to avoid disrupting legitimate email flows.

Recommended next steps

• Review mail flow, anti-phishing, and safe sender exceptions at both tenant and user levels.
• Reassess controls for spoofed trusted brands such as DocuSign, Adobe, and SurveyMonkey.
• Inspect defenses for SVG, PDF, and archive-based attachments.
• Strengthen awareness training around QR code phishing and Teams-based impersonation.
• Use Microsoft Defender hunting queries and IOCs from the report to validate whether related activity exists in your environment.

Microsoft’s Q3 data is a reminder that defenders need to monitor not only threat volume, but also the policy decisions and collaboration channels that can let malicious content slip through.