Microsoft Email Threat Landscape Q3 2026: tenant and user overrides delivered spoofed business-service mail that failed authentication, SVG attachments return as CAPTCHA-phishing carriers, and Teams impersonators move to ordinary personal names

Microsoft Threat Intelligence's report on Q3 2026 draws four points that matter to a Microsoft 365 defender (Microsoft Threat Intelligence, 2026-11-05). First, malicious messages that spoof the sender domains of business services, such as document-signing and survey platforms, were often delivered because tenant- or user-level overrides applied, even after the messages failed email authentication and were identified as malicious: in September overrides applied to 63% of messages with a recorded security outcome, most of them tenant-level (Microsoft Threat Intelligence, 2026-11-05). Microsoft says the figures do not show that recipients opened the messages and that an overly broad exception made for a legitimate workflow can weaken protection against messages impersonating it (Microsoft Threat Intelligence, 2026-11-05).

Second, CAPTCHA-gated phishing recovered while QR-code phishing kept falling, with SVG attachments central to the recovery: they carried 65% of CAPTCHA-gated attacks in August and 49% in September (Microsoft Threat Intelligence, 2026-11-05). Third, in Teams, ordinary personal-name display names rose from 46% of the observed July sample to 88% in September while explicit help-desk identities fell from 17% to 2%; Microsoft notes a personal name can accompany a help-desk claim while the account address keeps technical wording, and that more targeted attempts used domains resembling the victim organisation's (Microsoft Threat Intelligence, 2026-11-05). Fourth, an August campaign against legal organisations sent a Word document with a personalised QR code that led to a device-code phishing page and the genuine Microsoft device sign-in portal; completing the sign-in would have transferred a valid session token that gave persistent access without exposing the password or re-triggering MFA (Microsoft Threat Intelligence, 2026-11-05).