Microsoft reported detecting approximately 7.3 billion email-based phishing threats from July through September 2026. A significant increase was observed in September, with nearly 3 billion threats, marking a 41% rise from August.
Throughout Q3 2026, Microsoft identified around 129 million malicious messages spoofing the sender domains of tracked business services. DocuSign emerged as the most frequently spoofed brand in September, representing 29% of that month's spoofed messages.
In September 2026, tenant-level overrides were applied to 63% of messages with a recorded security outcome. Microsoft also noted a substantial decrease in QR code phishing attacks, with approximately 12.1 million detected over the quarter, a 67% drop from Q2.
PDF attachments were prevalent in QR code attacks, accounting for 78% in July and August, before decreasing to 61% in September. Conversely, email-embedded QR codes rose from 5% in July to 12% in September.
Credential theft remained the primary goal of phishing activities in Q3 2026. The disruption of the Tycoon2FA phishing-as-a-service platform in March 2026 led to a 99.8% reduction in phishing messages linked to it by July.