CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Microsoft Email Threat Landscape Q3 2026

report · report:microsoft-email-threat-landscape-q3-2026 single-source

Microsoft Threat Intelligence quarterly email-threat report (2026-11-05) covering Q3 2026: tenant- and user-level overrides applied to 63% of spoofed business-service messages with a recorded security outcome in September, SVG attachments leading CAPTCHA-gated phishing, Teams impersonators moving to ordinary personal names, and a device-code phishing campaign using a QR code in a Word document.

Coverage
1
first 2026-11-06 → last 2026-11-06
Latest activity
2026-11-06
Microsoft Q3 email report: overrides let authentication-failing spoofed mail through; SVG CAPTCHA phishing…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
1
1 hosts

Defender insights

What each entry about Microsoft Email Threat Landscape Q3 2026 tells a defender to do, newest first.

2026-11-06NOTABLEMicrosoft Q3 email report: overrides let authentication-failing spoofed mail through; SVG CAPTCHA phishing returns

Exposure · detection

Story timeline

  1. 2026-11-06Microsoft Email Threat Landscape Q3 2026: tenant and user overrides delivered spoofed business-service mail that failed authentication, SVG attachments return as CAPTCHA-phishing carriers, and Teams impersonators move to ordinary personal names
    researchMicrosoft Q3 email report: overrides let authentication-failing spoofed mail through; SVG CAPTCHA phishing returns

Hunting pivots

Affected products
Microsoft 365Microsoft Defender for Office 365Microsoft Teams
Tags
cloudidentityphishing
ATT&CK techniques (4 across 2 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessPhishing: Spearphishing Attachment · Phishing: Spearphishing Link · Phishing: Spearphishing Voice
  • Credential AccessSteal Application Access Token

Initial Access TA0001

T1566.001Phishing: Spearphishing Attachment×1

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-11-06/microsoft-email-threat-landscape-q3-2026-security-overrides · ATT&CK page ↗

T1566.002Phishing: Spearphishing Link×1

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-11-06/microsoft-email-threat-landscape-q3-2026-security-overrides · ATT&CK page ↗

T1566.004Phishing: Spearphishing Voice×1

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.

Evidence: 2026-11-06/microsoft-email-threat-landscape-q3-2026-security-overrides · ATT&CK page ↗

Credential Access TA0006

T1528Steal Application Access Token×1

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-11-06/microsoft-email-threat-landscape-q3-2026-security-overrides · ATT&CK page ↗

Entries about Microsoft Email Threat Landscape Q3 2026 (1)

2026-11-06 · view entry permalink →

NOTABLENATOB2

Microsoft Email Threat Landscape Q3 2026: tenant and user overrides delivered spoofed business-service mail that failed authentication, SVG attachments return as CAPTCHA-phishing carriers, and Teams impersonators move to ordinary personal names

Microsoft Threat Intelligence's report on Q3 2026 draws four points that matter to a Microsoft 365 defender (Microsoft Threat Intelligence, 2026-11-05). First, malicious messages that spoof the sender domains of business services, such as document-signing and survey platforms, were often delivered because tenant- or user-level overrides applied, even after the messages failed email authentication and were identified as malicious: in September overrides applied to 63% of messages with a recorded security outcome, most of them tenant-level (Microsoft Threat Intelligence, 2026-11-05). Microsoft says the figures do not show that recipients opened the messages and that an overly broad exception made for a legitimate workflow can weaken protection against messages impersonating it (Microsoft Threat Intelligence, 2026-11-05).

Second, CAPTCHA-gated phishing recovered while QR-code phishing kept falling, with SVG attachments central to the recovery: they carried 65% of CAPTCHA-gated attacks in August and 49% in September (Microsoft Threat Intelligence, 2026-11-05). Third, in Teams, ordinary personal-name display names rose from 46% of the observed July sample to 88% in September while explicit help-desk identities fell from 17% to 2%; Microsoft notes a personal name can accompany a help-desk claim while the account address keeps technical wording, and that more targeted attempts used domains resembling the victim organisation's (Microsoft Threat Intelligence, 2026-11-05). Fourth, an August campaign against legal organisations sent a Word document with a personalised QR code that led to a device-code phishing page and the genuine Microsoft device sign-in portal; completing the sign-in would have transferred a valid session token that gave persistent access without exposing the password or re-triggering MFA (Microsoft Threat Intelligence, 2026-11-05).

In September, overrides applied to 63% of messages with a recorded security outcome, with tenant-level overrides accounting for most of them.

The figures do not establish that recipients opened the messages or that accounts were compromised.

Microsoft Threat Intelligence 2026-11-05

Builds on: Microsoft's quarterly email report flags a sustained shift of social engineering into Teams… · Vaud: device-code phishing against Microsoft 365 is running in Romandie; several organisations… · Huntress: stolen post-MFA M365 tokens replayed within minutes; a password reset leaves planted… · Microsoft: Teams help-desk vishing into Quick Assist ended in AD CS certificates for privileged…

annual-report06 Nov 03:48Zsingle-sourceOpen finding →
Sources: Microsoft Threat Intelligence

explore in graph

Where this entity is cited

  • Research1

Source distribution

  • microsoft.com1 (100%)
All cited sources (1)