Microsoft Saw 7.3 Billion Email Phishing Threats in Q3. The Fix Is Still Layered Defenses, Not One Product
Microsoft’s Q3 email threat report shows phishing volume surging into September, spoofed business-service domains slipping through broad exceptions, and Teams callers dropping the obvious help-desk names. Here is a vendor-neutral checklist for SMB owners.
Layered email and identity defenses beat any single filter when phishing volume and MFA bypass tricks both rise
Microsoft Threat Intelligence says it detected about 7.3 billion email-based phishing threats from July through September 2026, with nearly 3 billion in September alone—up 41% from August. Volume is only half the story. The same report shows how security exceptions, familiar brand spoofing and collaboration-app social engineering keep opening doors after the spam filter has already voted “bad.”
We are reading Microsoft’s Email threat landscape: Q3 2026 trends and insights as a signal list for small and midsize businesses, not as a product pitch. Tools from any serious vendor can fill the layers below; the point is stacking the layers.
Signals that matter for SMB owners
- Spoofed business-service domains: About 129 million malicious messages spoofed tracked service domains (DocuSign was 29% of September’s spoofing in Microsoft’s set; Adobe, SurveyMonkey and Barracuda also rose late in the quarter). Many were still delivered because tenant- or user-level exceptions overrode protections even after authentication failed—63% of September messages with a recorded security outcome had an override, mostly at the tenant level.
- Credential theft still dominates attachments: Roughly 94–96% of payload-based attacks steered people to phishing sites or fake sign-in pages rather than installing malware. HTML and PDF stayed common; SVG attachments surged (10.1 million in August).
- QR codes cooled; CAPTCHA-gated mail warmed: QR phishing fell about 67% from Q2 to roughly 12.1 million in Q3. CAPTCHA-gated phishing nearly doubled from July’s low to 3.1 million in September, with SVG attachments central to that rebound.
- Business contact impersonation: About 6.2 million BCI attacks in Q3, down from Q2, but payroll and invoice lures still mattered for payment staff.
- Teams social engineering: About 141,000 malicious Teams call attempts in Q3. Display names shifted toward ordinary personal names (88% of the September sample) while obvious help-desk labels fell sharply.
- Campaign snapshots: An August “Salary Review” QR / device-code campaign hit legal orgs; a September Spanish-language purchase-order and payroll wave delivered Agent Tesla via disguised archives. Separately, Tycoon2FA-linked mail collapsed after the March disruption (about 21,000 messages in July versus 8.9 million in February).
A practical layered-defense checklist
- Authenticate the sender path: Enforce DMARC/DKIM/SPF on your own domains, and treat internal “allow” exceptions for DocuSign-like workflows as temporary and narrow—Microsoft’s data shows broad exceptions are how spoofed service mail still lands.
- Filter, then assume click: Keep attachment and link scanning on (including less common types such as SVG). Pair that with browser protections and endpoint controls so a missed mail is not game over.
- Make MFA phishing-resistant where it counts: Device-code and adversary-in-the-middle kits keep defeating OTP prompts. FIDO2 keys or comparable phishing-resistant methods matter for admins, finance and executives. (Microsoft products are one way to get there; they are not the only way.)
- Lock down collaboration side doors: Limit external Teams callers, coach staff that a friendly first name is not proof of identity, and verify money or access requests on a known-good number.
- Train for the lures you actually see: Payroll updates, invoices, salary PDFs with QR codes and “sign in to register for this AI event” pages are current themes—run short, role-specific drills for accounting and frontline staff.
- Respond like sessions are stolen: Plan for token and cookie theft: revoke sessions, reset across SSO apps, and review mailbox rules after a suspected phish—not password change alone.
- Measure exceptions quarterly: List every mail-flow exception that bypasses malware or phishing verdicts. If you cannot name the business owner and expiry date, remove it.
What this means for your company
A single secure-email gateway, a single MFA app, or a single awareness video will not match 7.3 billion automated attempts plus human-looking Teams calls. What works for SMBs is boring and layered: tight domain authentication, fewer blanket exceptions, phishing-resistant sign-in for people who can move money or admin tenants, and a habit of verifying unusual requests out-of-band. Use Microsoft’s numbers as a priority list, then implement the controls with whatever stack you already trust.
Want a vendor-neutral review of your email authentication, MFA strength, Teams external access and exception list against this quarter’s phishing patterns? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
