Microsoft logs 7.3 billion phishing emails in three months, most in September

Email phishing hit nearly 3 billion messages in September alone, a 41% jump from August, according to Microsoft. Much of the damage came not from new tricks but from old exceptions: security rules that let known business senders through, even after a message had already failed an authentication check. If a work email asks for a document review, a salary form or a purchase order approval, treat the request as unverified until checked another way.

What to do

• Check any request to review a salary document, invoice or purchase order by calling or messaging the sender through a separate, known channel.
• Report suspicious emails to the organization's IT or security team rather than clicking through or replying.
• Ask whether email exceptions for known vendors or services are reviewed regularly, since broad exceptions can let failed messages through anyway.

Microsoft Threat Intelligence counted approximately 7.3 billion email-based phishing threats across July, August and September. The jump in September did not carry across every technique. QR code phishing stayed well below its early-year peak. CAPTCHA-gated phishing, by contrast, reversed months of decline, helped along by a return to SVG file attachments.

One finding points to a structural weakness rather than a new trick. Microsoft detected approximately 129 million malicious messages spoofing the sender domains of tracked business services. Many of those were delivered anyway, because exceptions set up by organizations or individual users overrode security protections, even on messages that had already failed authentication and been flagged as malicious. The protection existed. It was switched off for convenience, and the switch worked for the attacker too.

In Microsoft Teams, attackers moved away from posing as help desk staff and toward ordinary personal names, while still relying on live, real-time conversation to do the persuading. Across attachment-based attacks generally, credential theft stayed the main goal in the third quarter.

Two campaigns from the quarter show the pattern in practice. In August, legal organizations received personalized salary review documents containing QR codes that led to device code phishing, a technique still in use even as QR attacks fell overall. In September, purchase order and payroll messages carried disguised archive files delivering Agent Tesla, malware built to collect credentials and other data. Different routes, same bet: that a routine business request will get opened without question.

The quarter also shows what sustained disruption can do. Following the March takedown of the Tycoon2FA phishing-as-a-service platform, Microsoft detected approximately 21,000 phishing messages linked to it by July, down 99.8% from 8.9 million in February, the month before the operation was disrupted.

The pattern across the quarter is the same one: volume moves fast, but the messages that get through most often do so because a legitimate exception was left open, not because the attacker found something new.

Check a message

Received something like this? Paste it into the Flggd message checker before you reply, click or pay.