Microsoft's security intelligence teams detected about 7.3 billion email-related phishing threats during the third quarter of 2026, an indication that attackers continue to rely on phishing messages as a main means of trying to steal accounts. And data.
A report published by the company on November 5 explained that September alone witnessed the discovery of nearly three billion threats, an increase of 41% compared to August, with a noticeable change in the deception methods used within messages.
Microsoft Security Blog
Impersonation of trademarks and services Professional
One of the most important trends identified in the report concerns messages that spoof the sending domains of services that companies use every day, such as document signing, survey and business management platforms.
According to Microsoft's findings, the number of malicious messages that spoofed domains reached The commercial services included in the analysis were about 129 million messages during the period from July to September.
The DocuSign service topped the tags that were subjected to this type of spoofing during September, as its name was associated with approximately 29% of the messages detected in this category in that month. The report was also monitored Activity aimed at imitating other services, including Adobe and SurveyMonkey.
This method helps attackers present the message in the form of a standard business request: signing a contract, reviewing an invoice, or completing an administrative procedure. The risk increases when the employee relies on the apparent service name without verifying it Actual sender ID.
These numbers do not mean that the companies whose names were hacked were hacked; The danger here relates to exploiting its fame and users’ trust in it.
A loophole in the protection policies themselves
The report pointed out a problem not related to the ability of security tools to detect malicious messages, but rather The way institutions set the rules of permission and exception.
In September, exceptions beyond some security resolutions were applied to 63% of malicious messages that had security findings recorded in the spoofing category analyzed by the report.
The company may make an exception to allow access Messages from a service that is important to its business, to avoid disrupting correspondence. But if the exception is too broad, it may allow messages impersonating that service to pass through.
Microsoft stresses that this percentage does not prove that users opened the messages or that their accounts were hacked. that it It reveals a potential weakness in your security settings that is worth reviewing.
Microsoft Security Blog
QR phishing is on the decline and fake verification pages are back
Not all fraud tactics move in the same direction.
The report recorded about 12.1 million phishing attempts using QR codes during the third quarter, a decrease of 67%. Compared to the previous quarter.
In contrast, campaigns using CAPTCHA-like verification pages are back on the rise, with about 3.1 million attempts recorded during September, nearly double the level recorded in July.
Attackers take advantage of these pages to give the experience a natural appearance Accessing a fake website, or to confuse the user before prompting him to enter his account information.
The report also indicated the use of SVG attachments in some campaigns, which are files that may appear to the user to be ordinary graphic elements, but require caution when they arrive from unknown parties.
Login data theft It remains the main goal
The report reflects attackers' continued focus on login data, especially work accounts, corporate mail, and cloud services.
These accounts are of great importance because they may give the attacker access to company information, correspondence, or services Related, if the phishing operation is successful and there are not sufficient additional protections.
Microsoft also detected social engineering attempts through Microsoft Teams, including using the names of ordinary people in fraudulent communications instead of simply impersonating technical support teams.
This shows that The threat is no longer limited to emails, but may spread between mail, collaboration applications, calls, and other means of communication.
What does this mean for organizations?
The most notable finding is that updating anti-phishing tools alone is not enough.
Organizations need to review exceptions Allow email, check sender authentication settings, reduce unnecessary permissions, and enable strong anti-phishing authentication methods where possible.
Employees should also be trained not to handle password change, money transfer or unlock requests Sensitive documents based only on a familiar service name or logo.
What's next?
It is expected that campaigns will continue to modify their methods as monitoring tools improve. So security teams will be able to detect small changes in message behavior, and not just look for known fraud templates, A crucial factor in reducing risks.
