Phishing Surges to 7.3 Billion Emails in Q3 as Attackers Shift Tactics and Exploit Security Exceptions

Microsoft Threat Intelligence detected about 7.3 billion email-based phishing threats between July and September, including nearly 3 billion in September alone, up 41% from August. The rise did not apply to every technique. QR code phishing stayed well below its early-year peak, while CAPTCHA-gated phishing reversed several months of decline, driven in part by renewed use of SVG attachments. Credential theft remained the main goal of malicious attachments.

The quarter also showed how security exceptions can undermine protection. Microsoft detected roughly 129 million malicious messages spoofing the sender domains of tracked business services. Many were still delivered because organisation- or user-configured exceptions overrode security protections, even after the messages failed authentication checks and were flagged as malicious. Exceptions meant to keep legitimate workflows running can leave businesses open to impersonation. In Microsoft Teams, attackers increasingly used ordinary personal names instead of explicit help desk identities, while still using live interactions for social engineering.

Two campaigns show the range of activity. In August, a campaign against legal organisations used personalised salary review documents and QR codes to lead recipients into device code phishing. In September, purchase order and payroll lures used disguised archives to deliver Agent Tesla, malware commonly used to collect credentials and other information. Meanwhile, the March disruption of the Tycoon2FA phishing-as-a-service platform continued to show results: by July, linked messages fell to about 21,000, down 99.8% from 8.9 million in February.