Phishing Techniques Rotate Every Quarter: What Microsoft's Q3 2026 Data Shows

Ask any security team what phishing looked like in the spring and you will probably hear about QR codes. Ask again after the summer and the answer has changed. Microsoft's latest quarterly email threat report shows how quickly attackers move on from a technique once defenders start catching it, and what they pick up in its place.

In short: Microsoft detected around 7.3 billion email-based phishing threats in the third quarter of 2026. Some headline techniques, such as QR code phishing, fell sharply, while others, such as CAPTCHA-gated phishing delivered through SVG files, climbed back. The practical lesson is to defend against the behaviour behind a technique, not the technique of the moment.

All the figures below come from Microsoft's Q3 2026 email threat landscape report. They are Microsoft's detection counts, which measure detected activity rather than confirmed victims.

How big was the quarter, and what changed?

Microsoft reports roughly 7.3 billion phishing threats detected between July and September. September alone brought nearly 3 billion, up 41% on August. Volume rose at the end of the quarter, but not every technique rose with it.

QR code attacks are the clearest example. Microsoft counted about 12.1 million in Q3, down 67% on Q2, and September was 86% below the March peak. The attachment mix shifted too. PDFs carried 78% of QR attacks in July and August but 61% in September, while QR codes placed directly in the email body rose from 5% in July to 12% in September.

Malicious payloads show the same churn. SVG files peaked in August at 10.1 million messages, the highest monthly volume in over a year, then fell 34% in September. Word documents and similar formats dropped from about 5% of payload attacks to under 3%. Across all of these formats, around 94 to 96% of payload-based attacks aimed at stealing credentials, either by sending people to a phishing site or by showing a fake sign-in page locally.

That last point matters most. The container changes every few weeks. The goal does not.

Why did CAPTCHA-gated phishing come back?

CAPTCHA-gated phishing hides the real phishing page behind a "prove you are human" step. Automated scanners often cannot complete it, so the page they see looks harmless, while a person clicking through gets the fake sign-in. Microsoft recorded 3.1 million of these attacks in September, nearly double the July low, though still well below the March peak.

SVG attachments drove the recovery. They made up 17% of CAPTCHA-gated attacks in July, 65% in August and 49% in September, and volume rose sixfold in August. An SVG looks like an image to many people, yet it can carry script and links, which is why it keeps appearing in attacker toolkits.

What did the two featured campaigns look like?

Microsoft described two campaigns in detail. In the first, on 19 and 20 August, more than 10,000 users at over 4,800 organisations received a salary review lure, mostly in the US, with 72.1% of intended targets in professional services and a focus on law firms. The emails had no body text, just a Word attachment containing a personalised QR code. That code led to a fake OneDrive page using device code phishing to capture a session token.

The second, on 21 September, was a Spanish-language purchase order and payroll campaign delivering Agent Tesla, a credential-stealing tool. It reached more than 56,000 users at over 8,100 organisations. The sending domain passed SPF, DKIM and DMARC, which shows that passing email authentication tells you the sender controls the domain, not that the message is safe.

What about impersonation of business services and Teams calls?

About 129 million malicious messages spoofed tracked business-service domains such as e-signature and invoicing platforms. DocuSign was the most spoofed brand in September at 29% of that month's total, with Adobe also among the brands rising late in the quarter. Microsoft also found that in September, overrides applied to 63% of messages with a recorded security outcome, mostly at tenant level. The data does not show whether recipients opened them. Microsoft's own summary is blunt: "Familiar branding is not a substitute for an authenticated sender."

Microsoft Teams was a smaller channel, with about 141,000 malicious call attempts. Volume peaked in July and fell 31% by September, though it stayed 38% above the first-half monthly average. One detail stands out. Display names using ordinary personal names rose from 46% of the July sample to 88% in September, while explicit help desk identities fell from 17% to 2%. Microsoft cautions that many attempts were unanswered, rejected or short, so they should not be read as successful attacks.

What should organisations do with this?

A quarterly report is a snapshot, so the useful move is to build habits and controls that survive the next shift. Based on Microsoft's recommendations and the patterns above:

• Review exceptions. Allow lists and overrides for business-service senders can let spoofed mail straight through. Check them regularly and keep them narrow.
• Treat unusual attachments with the same care as links. A QR code in a Word file, or an SVG that opens a page, deserves a second look from anyone, whatever the file type.
• Prefer sign-in methods that resist phishing. Passwordless options and phishing-resistant MFA for privileged accounts reduce what a stolen session or fake page can achieve.
• Limit external Teams contact. Restrict or review external chats and meetings, and encourage people to verify unexpected callers through a separate channel.
• Switch on the basics. Zero-hour auto purge, Safe Links and Safe Attachments help remove or block mail after delivery.
• Practise the pause. Run simulations across email, QR codes and chat so people rehearse the same checks in every channel.

The bottom line

The Q3 numbers do not say phishing is shrinking. They say it is shifting shape. QR codes fell, SVG-fuelled CAPTCHA pages rose, and business-service lookalikes kept flowing. People are a defence layer worth equipping, and the most durable thing you can give them is a habit that works in any format: stop, check the sender through another route, and report anything odd. Technical controls catch much of the rest, and between them the next change of technique costs attackers more than it costs you.

Frequently asked questions

Did QR code phishing really decline?

Microsoft counted about 12.1 million QR code attacks in Q3, down 67% on Q2. That is a fall in detected volume, and the technique still appears, so it is worth keeping in training.

What is CAPTCHA-gated phishing?

It places a human-verification step in front of a fake sign-in page so automated scanners see a harmless page. Microsoft recorded 3.1 million such attacks in September.

Do these figures show how many people were compromised?

No. They are Microsoft's detection counts for threats it identified, not confirmed victims or successful attacks.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.