Q3 2026 Email Threat Landscape: Spoofed Business Service Domains and Phishing Trends

Microsoft Threat Intelligence observed approximately 7.3 billion email-based phishing threats between July and September 2026. While QR code phishing (quishing) has declined from earlier 2026 peaks, attackers are increasingly leveraging trusted brand identities by spoofing sender domains for business services such as DocuSign, Adobe, SurveyMonkey, and Barracuda. A critical finding is the role of organizational security overrides; in September, 63% of malicious messages that failed authentication and were flagged by security systems were nonetheless delivered due to tenant- or user-level exceptions intended to preserve legitimate workflows.

Attack Chain

1. Attacker spoofing: Attacker spoofs the sender domain of a legitimate business service (e.g., DocuSign).
2. Configuration bypass: Attacker targets environments with overly broad security exception policies that allow unauthenticated messages from these service domains.
3. Lure delivery: Phishing email containing lures (salary reviews, purchase orders) is delivered to the target inbox due to the security override.
4. Credential theft: User interacts with malicious links (e.g., device code phishing) or attachments (e.g., disguised archives).
5. Payload execution: Execution of credential-harvesting malware such as Agent Tesla.
6. Data exfiltration: Malware collects and exfiltrates credentials and sensitive information.

Impact

Attackers are successfully delivering malicious emails by exploiting configuration-level trust, increasing the risk of credential theft and unauthorized access to business-service accounts. While the specific number of compromised accounts remains unconfirmed, the volume of spoofed messages delivered despite security identification reached approximately 129 million across tracked services.

Recommendation

• Conduct an immediate audit of email tenant-level and user-level allowlists or bypass policies for common business-service domains (e.g., DocuSign, Adobe, SurveyMonkey).
• Enforce strict SPF, DKIM, and DMARC authentication for all incoming mail; avoid creating blanket exceptions for entire sender domains when specific sub-domains or individual senders can be authenticated.
• Review and restrict the use of device code authentication flows, which attackers are leveraging in phishing campaigns to bypass traditional MFA.
• Implement and enforce baseline security policies in Microsoft Teams, monitoring for social engineering attempts that impersonate personal identities rather than administrative help desk personas.