Microsoft Threat Intelligence finds CAPTCHA phishing rose as QR-code attacks fell

Microsoft Threat Intelligence recorded roughly 7.3 billion e-mail-based phishing threats across the third quarter of 2026, spanning July through September 2026. September 2026 alone accounted for nearly 3 billion e-mail-based phishing threats, up 41% from August 2026.

QR code phishing fell approximately 67% from Q2 2026 to 12.1 million attacks in Q3 2026. Embedded email QR codes rose from 5% in July 2026 to 12% in September 2026, with body-embedded volume more than tripling by quarter end.

CAPTCHA-gated phishing reached 3.1 million attacks by September 2026, nearly twice July 2026’s low. SVG files accounted for 65% of CAPTCHA-gated phishing attacks in August 2026 and held at 49% in September 2026. SVG is a vector image format used to render graphics in email messages.

Microsoft reported roughly 129 million malicious messages in Q3 2026 that impersonated tracked business-service sender domains, meaning domains used by legitimate services that attackers mimic. Spoofed business-service domain volume stayed roughly steady at 41 million to 46 million messages per month from May 2026 through Q3 2026.

DocuSign was the most spoofed brand in September 2026, representing 29% of that month’s spoofed messages among tracked business-service sender domains. Spoofing of Adobe, SurveyMonkey, and Barracuda increased toward the end of Q3 2026.

Many spoofed messages reached recipients because tenant- or user-level exceptions overrode security protections despite authentication failures. Microsoft said tenant-level overrides drove most September 2026 exceptions affecting 63% of messages with a recorded security result.

Ordinary personal names replaced explicit help desk identities in Microsoft Teams attacks, climbing from 46% in July 2026 to 88% in September 2026. Explicit help desk display names fell from 17% in July 2026 to 2% in September 2026.

About 141,000 malicious Teams call attempts occurred in Q3 2026, a 31% decline from July to September 2026. September Teams call volume remained 38% above the first-half 2026 monthly average.

Credential theft stayed the main goal for malicious attachments throughout Q3 2026. About 94-96% of Q3 2026 payload-based attacks, meaning messages carrying malicious attachments or links, sent recipients to a phishing site or showed a fraudulent sign-in page locally.

HTML and PDF attachments together accounted for approximately 56-62% of monthly payload-based attacks in Q3 2026. PDFs led malicious payloads in August and September 2026, with volume falling just 2% from July 2026. HTML is a markup language used to structure e-mail content.

SVG attachment volume in malicious payloads reached 10.1 million in August 2026, the highest monthly volume in more than a year. DOC/DOCX malicious payload attachments fell 76% below their first-half 2026 monthly average by September 2026. DOC/DOCX is Microsoft Word’s document format.

Microsoft Threat Intelligence said a salary review campaign dated August 19, 2026, used QR code device code phishing, which abuses the device login flow to steal credentials, against more than 10,000 users and more than 4,800 U.S. organizations. The campaign sent e-mails from smtp[@]wekash[.]net via Amazon Simple Email Service, Amazon’s bulk e-mail sending platform, with the subject line Salary Review. The Word document used a QR code to direct users to a OneDrive sign-in impersonation page at splace[.]co[.]za based on device code authentication.

The September 21, 2026 campaign reached more than 56,000 users at more than 8,100 organizations using purchase order and payroll themes to deliver Agent Tesla. The sender address contacto06[@]carloxmextos[.]org passed SPF, DKIM, and DMARC authentication, email verification standards that check whether a sender is authorized to use a domain.

After the March 2026 Tycoon2FA disruption, linked phishing messages fell to approximately 21,000 by July 2026. That figure marked a 99.8% decline from February 2026’s 8.9 million linked phishing messages.

Business contact impersonation volume fell to approximately 6.2 million attacks in Q3 2026, with September 2026 at its lowest since at least July 2025. Invoice payment requests in business contact impersonation rose 89% in September 2026, more than tripling since June 2026.

Newshub recommends checking mail flow rules, which govern how messages are routed, anti-phishing settings, and safe sender exceptions, which let listed addresses bypass filters, for tenants and users. Newshub says organizations should reassess defenses against spoofed trusted brands including DocuSign, Adobe, and SurveyMonkey.