Executive summary
Microsoft's 5 November report describes approximately 7.3 billion detected email-based phishing threats during July–September 2026, with nearly three billion in September. Those are detections in Microsoft's visibility, not verified compromises or a census of global email. The report's most actionable finding concerns messages that security systems identified as malicious but exception policies still allowed through. Microsoft
TIR assessment — likely (B2): exception governance deserves attention alongside detection tuning. A security service can recognise an attack while a broad user or organisation override undermines the intended protection. The required investigation is whether the exception is justified and appropriately scoped, not merely whether a product generated an alert.
The denominator behind the override finding
Microsoft detected about 129 million malicious messages spoofing the domains of the business services tracked in its analysis during Q3. The report describes familiar document-signing, invoice and survey workflows as the context attackers imitate. It distinguishes spoofing a service's actual sender domain from using only a misleading display name or lookalike domain. Microsoft
For September, overrides applied to 63 per cent of messages with a recorded security outcome in that analysis; tenant-level exceptions accounted for most of them. This does not mean 63 per cent of all email was malicious, that every spoofed message was delivered, or that recipients acted on the delivered messages. It identifies a specific control path worth checking.
When reviewing an exception, establish the intended workflow, its owner, the exact matching conditions and the security actions it can override. TIR recommends testing whether an attacker impersonating that workflow can satisfy the same conditions. A familiar business-service name is not evidence that a message actually originated from the service.
Falling volume does not remove a technique
QR-code phishing declined substantially in Microsoft's observations, while CAPTCHA-gated phishing recovered later in the quarter. The report also describes a return of malicious SVG attachments. These patterns concern different populations and techniques, so their percentages should not be combined into a single measure of phishing success. Microsoft
An August campaign against legal organisations illustrates why a declining method still matters. Microsoft reports personalised compensation-review documents carrying QR codes and leading recipients into device-code phishing. The intended recipient was asked to complete authentication through Microsoft's legitimate device-login service, with the attack abusing that authorised flow to obtain access. The report gives targeting counts, not a count of successful account takeovers.
A September campaign used Spanish-language purchase-order and payroll themes to deliver Agent Tesla through disguised attachments. Sender authentication passed for the domain described in that case. That demonstrates a separate limit: valid domain authentication does not make a message's content or claimed business relationship trustworthy. It is not the same failure mode as the spoofed-domain override population.
Review delivery, interaction and compromise separately
An incident timeline should record whether the message was detected, allowed by policy, delivered, opened, followed, and associated with later identity or endpoint activity. These are separate stages. A delivery event is not a compromise, while a blocked message does not establish that the same recipient received no alternative lure.
For device-code cases, preserve identity and authentication evidence as well as the message and landing-page indicators. For executable attachment cases, connect email provenance to the endpoint's process tree. Investigation should follow the observed path instead of assuming that every phishing campaign installs malware or captures a password. Microsoft
Practical defensive priorities
TIR recommends an owned review of broad allow rules and other exceptions, including their business rationale and expiry. Test changes against the legitimate workflow so the control is not simply disabled again after an avoidable outage. This is a response recommendation, not a claim that Microsoft measured the effect of a particular governance process.
Microsoft's guidance includes reviewing mail-protection settings, investigating delivered malicious messages, retroactive message removal, attachment and link protection, and stronger authentication. It also addresses external Teams interactions and verification before acting on requests. Apply those controls with awareness of the products and licences actually deployed; a recommendation in a vendor report is not evidence that a tenant already has it enabled. Microsoft
For hunting, combine message, collaboration, identity and endpoint records where available. The report's example indicators are dated to observed campaigns. Preserve those dates and assess false positives, especially where legitimate hosting or shared services are involved. Do not treat old infrastructure as an indefinitely current blocking list.
What the report does not establish
The research does not provide a universal phishing-conversion rate, prove that every policy override was unjustified, or establish the effectiveness of one defensive product against every technique. Its value is the distinction between detecting a malicious message and allowing an exception to determine what happens next.
