Microsoft Threat Intelligence has published its email threat landscape report for the third quarter of 2026, and the headline number is hard to ignore: approximately 7.3 billion email-based phishing threats were detected between July and September, with a sharp increase to nearly 3 billion in September alone, up 41% from August.
The report, published on November 5 on the Microsoft Security Blog, tracks several shifts that matter for anyone who runs email infrastructure or sends bulk mail.
Spoofed business services and the override problem
Microsoft detected approximately 129 million malicious messages spoofing the sender domains of tracked business services during the quarter. Instead of using lookalike domains, these messages claimed the actual domains of services people trust for document signing, invoices and surveys. DocuSign was the most spoofed brand in September, accounting for 29% of that month’s total, with Adobe, SurveyMonkey and Barracuda also seeing increases toward the end of the quarter.
The more consequential finding concerns what happened after detection. Many of these messages failed email authentication checks and were identified as malicious, yet they were still delivered because organization- or user-configured security overrides took precedence. In September, overrides applied to 63% of messages with a recorded security outcome, with tenant-level overrides accounting for most of them. An exception created to keep a legitimate workflow running can quietly become an open door for messages impersonating that same workflow.
Passing DMARC is not proof of trust
A Spanish-language campaign observed on September 21 shows the other side of the authentication story. Messages with purchase order lures and payroll lures reached more than 56,000 users across more than 8,100 organizations, with Colombia, the United States, Mexico, Chile and Spain as the top intended recipient countries. The sender domain passed SPF, DKIM and DMARC, because the attacker had registered a domain and set up authentication properly, while changing the display name to resemble a sales or human resources identity from the recipient’s organization. The attachments were disguised RAR archives that delivered Agent Tesla malware, with one chain fetching a PowerShell payload from Firebase Storage.
This is the pattern that makes DMARC enforcement and monitoring inseparable. Attackers increasingly authenticate their own domains, so a DMARC pass only tells you the message really came from that domain, not that the domain deserves trust. Meanwhile, your own domain only stays safe from exact-domain spoofing if your DMARC policy is actually enforced.
QR codes down, SVG files up
QR code phishing fell approximately 67% from Q2 to about 12.1 million attacks, with September volume 86% below the March peak. CAPTCHA-gated phishing moved the other way, recovering to 3.1 million attacks in September, nearly twice the July low, driven largely by SVG attachments. SVG volume increased sixfold in August, when SVG files represented 65% of CAPTCHA-gated attacks, and they remained the leading delivery method at the end of the quarter.
Credential theft stayed the dominant objective: roughly 94 to 96% of payload-based attacks in Q3 directed recipients to a phishing site or a fraudulent sign-in page rather than installing malware. The March disruption of the Tycoon2FA phishing-as-a-service platform continued to bite, with linked messages down 99.8% in July compared to February.
Business contact impersonation declined to approximately 6.2 million attacks, but invoice payment requests more than tripled between June and September. In Microsoft Teams, attackers shifted from obvious help desk identities to ordinary personal names, which rose from 46% of the observed July sample to 88% in September.
What to do about it
The report is a reminder that authentication work is never finished. Enforce DMARC at reject for your own domains, audit every allowlist and tenant override that bypasses authentication checks, and treat a passing DMARC result as identity verification rather than an endorsement. If you want a sending platform that takes authentication and deliverability seriously from day one, sign up for free to Excello Mail.