---
title: Hunt: Microsoft's Q3 email threats: 7.3 billion phishing detections, CAPTCHA-gated phishing back via SVG attachments, and spoofed mail delivered because of allow-list exceptions | ctxsec
url: https://ctxsec.com/items/hunt-microsoft-email-threat-landscape-q3-2026-captcha-svg-spoofed-exceptions
description: "Microsoft Threat Intelligence detected about 7.3 billion email phishing threats in July-September, with nearly 3 billion in September alone (up 41% from August). QR-code phishing stayed far below its early-2026 peak, while CAPTCHA-gated phishing rose again, partly through SVG attachments. About 129 million malicious messages spoofed the domains of tracked business services, and many were delivered because organization- or user-configured exceptions overrode protections even after the messages failed authentication. In Teams, attackers increasingly used ordinary personal names rather than obvious 'help desk' identities. The post includes hunting queries and IOCs."
status: "official (Microsoft Threat Intelligence, Nov 5)"
published: 2026-11-05
---

> Microsoft Threat Intelligence detected about 7.3 billion email phishing threats in July-September, with nearly 3 billion in September alone (up 41% from August). QR-code phishing stayed far below its early-2026 peak, while CAPTCHA-gated phishing rose again, partly through SVG attachments. About 129 million malicious messages spoofed the domains of tracked business services, and many were delivered because organization- or user-configured exceptions overrode protections even after the messages failed authentication. In Teams, attackers increasingly used ordinary personal names rather than obvious 'help desk' identities. The post includes hunting queries and IOCs.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-microsoft-email-threat-landscape-q3-2026-captcha-svg-spoofed-exceptions.md)

official (Microsoft Threat Intelligence, Nov 5)

2026-11-05

### Hunt: Microsoft's Q3 email threats: 7.3 billion phishing detections, CAPTCHA-gated phishing back via SVG attachments, and spoofed mail delivered because of allow-list exceptions

- Audit transport rules, allow lists and spoof-intelligence overrides that let mail failing SPF/DKIM/DMARC through; scope any you need to specific senders and IPs.
- Hunt for inbound `.svg` attachments and links to pages that show a CAPTCHA before a sign-in form.
- Restrict external Teams chat to allowed domains and warn users that 'IT support' may arrive under an ordinary name.
- Microsoft's post has Defender hunting queries you can run as-is.

Sources: [Microsoft Security Blog: Email threat landscape: Q3 2026 trends and insights (Nov 5)](https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/)