{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/surveymonkey/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft Teams","Microsoft Defender"],"_cs_severities":["high"],"_cs_tags":["phishing","email-security","credential-theft","spoofing","security-misconfiguration"],"_cs_type":"advisory","_cs_vendors":["Microsoft","DocuSign","Adobe","SurveyMonkey","Barracuda"],"content_html":"\u003cp\u003eMicrosoft Threat Intelligence observed approximately 7.3 billion email-based phishing threats between July and September 2026. While QR code phishing (quishing) has declined from earlier 2026 peaks, attackers are increasingly leveraging trusted brand identities by spoofing sender domains for business services such as DocuSign, Adobe, SurveyMonkey, and Barracuda. A critical finding is the role of organizational security overrides; in September, 63% of malicious messages that failed authentication and were flagged by security systems were nonetheless delivered due to tenant- or user-level exceptions intended to preserve legitimate workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker spoofing: Attacker spoofs the sender domain of a legitimate business service (e.g., DocuSign).\u003c/li\u003e\n\u003cli\u003eConfiguration bypass: Attacker targets environments with overly broad security exception policies that allow unauthenticated messages from these service domains.\u003c/li\u003e\n\u003cli\u003eLure delivery: Phishing email containing lures (salary reviews, purchase orders) is delivered to the target inbox due to the security override.\u003c/li\u003e\n\u003cli\u003eCredential theft: User interacts with malicious links (e.g., device code phishing) or attachments (e.g., disguised archives).\u003c/li\u003e\n\u003cli\u003ePayload execution: Execution of credential-harvesting malware such as Agent Tesla.\u003c/li\u003e\n\u003cli\u003eData exfiltration: Malware collects and exfiltrates credentials and sensitive information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers are successfully delivering malicious emails by exploiting configuration-level trust, increasing the risk of credential theft and unauthorized access to business-service accounts. While the specific number of compromised accounts remains unconfirmed, the volume of spoofed messages delivered despite security identification reached approximately 129 million across tracked services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eConduct an immediate audit of email tenant-level and user-level allowlists or bypass policies for common business-service domains (e.g., DocuSign, Adobe, SurveyMonkey).\u003c/li\u003e\n\u003cli\u003eEnforce strict SPF, DKIM, and DMARC authentication for all incoming mail; avoid creating blanket exceptions for entire sender domains when specific sub-domains or individual senders can be authenticated.\u003c/li\u003e\n\u003cli\u003eReview and restrict the use of device code authentication flows, which attackers are leveraging in phishing campaigns to bypass traditional MFA.\u003c/li\u003e\n\u003cli\u003eImplement and enforce baseline security policies in Microsoft Teams, monitoring for social engineering attempts that impersonate personal identities rather than administrative help desk personas.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:29:53Z","date_published":"2026-11-05T22:29:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-email-threat-landscape/","summary":"Microsoft reported a sharp rise in phishing activity in Q3 2026, characterized by the abuse of spoofed business-service domains and the exploitation of overly permissive organizational security overrides to deliver credential-harvesting threats.","title":"Q3 2026 Email Threat Landscape: Spoofed Business Service Domains and Phishing Trends","url":"https://feed.craftedsignal.io/briefs/2026-11-email-threat-landscape/"}],"language":"en","title":"CraftedSignal Threat Feed - SurveyMonkey","version":"https://jsonfeed.org/version/1.1"}