Email threat landscape: Q3 2026 trends and insights

1. Spoofed sender domains
2. QR code phishing attacks
3. CAPTCHA-gated phishing tactics
4. Malicious payloads
5. Business contact impersonation
6. Microsoft Teams threats
7. Notable phishing campaigns
8. Defending against email and collaboration threats
9. Hunting queries
10. Indicators of compromise (IOCs)

Microsoft Threat Intelligence detected approximately 7.3 billion email-based phishing threats from July through September, including a sharp increase to nearly 3 billion in September alone, up 41% from August. Yet the increase did not extend across the techniques that had driven threat actor activity earlier in the year. QR code phishing remained far below its early-year peak, while CAPTCHA-gated phishing reversed several months of decline, driven in part by renewed use of SVG attachments.

Q2 in review

Shifting tactics and other trends ›

Figure 1. Monthly detected email threat volume (January – September 2026)

The quarter also highlighted how sender identity and security exceptions can shape the outcome of detected threats. Microsoft detected approximately 129 million malicious messages spoofing the sender domains of tracked business services. Many were delivered because organization- or user-configured exceptions overrode security protections, even after the messages failed authentication checks and were identified as malicious, showing how overly broad exceptions intended to preserve legitimate workflows can also expose them to impersonation. In Microsoft Teams, attackers increasingly used ordinary personal names rather than explicit help desk identities while continuing to use live interactions for social engineering. Across malicious attachment activity more broadly, credential theft remained the dominant objective in Q3.

Two campaigns observed during the quarter illustrate the range of activity behind these trends. An August campaign targeting legal organizations used personalized salary review documents and QR codes to lead recipients into device code phishing, despite the broader decline in QR code attacks. In September, purchase order and payroll lures used disguised archives to deliver Agent Tesla, malware commonly used to collect credentials and other information. Together, the campaigns show how familiar business requests remained effective lures across distinct attack paths.

TYCOON2FA

Inside the PhaaS platform ›

The effects of the March disruption of the Tycoon2FA phishing-as-a-service (PhaaS) platform also remained evident. By July, Microsoft detected approximately 21,000 phishing messages linked to the platform, down 99.8% from 8.9 million in February, the last full month before the operation.

Figure 2. Tycoon2FA-linked phishing email volume (January 2026 – July 2026)

This blog provides a view of email threat activity across Q3 2026, examining shifts in phishing techniques, malicious payloads, business contact impersonation (BCI), and Teams-based threats. We also highlight spoofed business-service sender domains and two campaigns that show how attackers used familiar work requests to make malicious messages appear credible. Together with recommendations, Microsoft Defender detections, and hunting queries, these findings can help defenders assess where existing protections may be weakened and investigate activity across email and collaboration platforms.

Spoofed sender domains

Requests to sign a document, review an invoice, or respond to a survey are routine business communications. Attackers exploit that familiarity by spoofing the sender domains of the legitimate services that deliver them. Rather than relying only on a misleading display name or a lookalike domain, these messages claim the service’s actual domain as their sender identity.

Microsoft detected approximately 129 million malicious messages spoofing the business-service domains tracked in this analysis during Q3. Activity had remained consistently high since at least May, at roughly 41 million to 46 million messages a month. DocuSign was the most frequently spoofed brand in September, accounting for 29% of that month’s total. Adobe, SurveyMonkey, and Barracuda also saw increases toward the end of the quarter, even as overall spoofing volume remained broadly steady.

Figure 3. Malicious messages spoofing tracked business-service sender domains (May – September 2026)

The more consequential finding was how security exceptions affected these messages after detection. Despite failing email authentication checks and being identified as malicious, many were associated with tenant- or user-level overrides. In September, overrides applied to 63% of messages with a recorded security outcome, with tenant-level overrides accounting for most of them.

The figures do not establish that recipients opened the messages or that accounts were compromised. They do show why exception policies deserve attention alongside detection coverage. An organization may create an exception to avoid interrupting a legitimate business workflow, but an overly broad exception can also weaken protection against messages impersonating that workflow. Familiar branding is not a substitute for an authenticated sender.

QR code phishing attacks

QR code phishing ended Q3 far below the levels seen during its early-year surge. Microsoft detected approximately 12.1 million attacks over the quarter, down 67% from Q2. The decline continued through September despite the broader increase in email threats, leaving monthly QR code volume 86% below its March peak.

Figure 4. Monthly QR code phishing volume (January – September 2026)

Much of the volume reduction came from the attachments that had supported that earlier growth:

• PDF attachments remained the most common delivery format in Q3, accounting for 78% of QR code attacks in July and August before dropping to 61% in September. Nonetheless, the volume of PDFs carrying malicious QR codes fell by roughly 65% by the end of the quarter.
• DOC/DOCX attachments accounted for 14% of QR code attacks in July and August before rising to 20% in September. Word document delivery volume similarly contracted in Q3, falling 39% between July and September following a sharp drop at the start of the quarter.
• Email-embedded QR codes increased from 5% of attacks in July to 12% in September. After dropping to near-zero in Q2, the volume of malicious QR codes embedded in email bodies more than tripled by the end of Q3, although the method remained a smaller delivery category than attachments.

Figure 5. QR code phishing delivery method share by month (January – September 2026)

The distinction between delivery methods matters for inspection coverage, but not for the recipient’s experience: either attachment or embedded formats can move a user from a message on a managed device to a phishing page on a personal phone. The reduction in volume has not changed that underlying challenge.

CAPTCHA-gated phishing tactics

CAPTCHA-gated phishing began to recover while QR code attacks continued to fall. By September, Microsoft detected 3.1 million CAPTCHA-gated attacks, nearly twice the volume seen at July’s low. Activity remained well below its March peak, but the recovery ended several months of sustained decline.

Figure 6. CAPTCHA-gated phishing volume (January – September 2026)

The increase in CAPTCHA-gated phishing attacks was not confined to a single attachment format as delivery methods shifted throughout Q3, though SVG attachments were central to the initial recovery.

• SVG attachment volume increased sixfold in August, accounting for almost half of September’s total CAPTCHA-gated phishing attacks. Up from 17% of attacks in July, SVGs represented 65% of CAPTCHA-gated phishing attacks in August, remained elevated at 49% in September, and were the leading delivery method at the quarter end.
• Email-embedded URLs accounted for 49% of attacks in July before falling to 19% in August as SVG activity surged. URL-delivered attacks more than doubled in September, reclaiming 30% of attacks.
• PDF attachments declined from 22% of attacks in July to 12% in August, remaining at 12% in September.
• HTML attachments declined from 9% of attacks in July to 2% in August, then more than tripled in volume in September to account for 6% of attacks.
• DOC/DOCX attachments remained comparatively uncommon throughout Q3, representing only 1% of attacks each month.

Figure 7. CAPTCHA-gated phishing distribution method share by month (April – September 2026)

Malicious payloads

The dominant risk from malicious attachments continued to be credential theft, not malware installation. Approximately 94-96% of payload-based attacks during Q3 directed recipients toward a phishing site or presented a fraudulent sign-in page locally. An attachment did not need to install software to put an account at risk.

HTML and PDF attachments remained the two most common malicious payload types during Q3, together accounting for approximately 56–62% of payload-based attacks each month, while the more significant change was the return of SVG files:

Figure 8. Malicious payloads by type

• HTML attachments accounted for nearly two-thirds of malicious payloads and remained relatively steady across the quarter. HTML files ranked first in July at 32% of attacks before declining to 26% in August and recovering to 29% in September.
• PDF attachments accounted for 27–30% of attacks and were the leading payload type in August and September. Volume remained comparatively stable, declining only 2% between July and September.
• SVG attachments increased from 13% of attacks in July to 20% in August, when volume reached 10.1 million—the highest monthly volume in more than a year. Volume then fell 34% in September, although SVGs still represented 13% of attacks and remained roughly 50% higher than the monthly average for the first half of 2026.
• DOC/DOCX attachments declined from approximately 5% of attacks in July and August to less than 3% in September, falling 76% below its monthly average volume for the first half of 2026.
• ZIP/GZIP attachments declined from 5% of attacks in July to 3% in August before recovering slightly to 4% in September. Raw volume remained 24% below July.

The reduced use of Word documents alongside the renewed use of SVG files left a different mix of attachment threats, though credential theft remained the dominant objective.

Figure 9. Malicious payload file type distribution by month (June – September 2026)

CAPTCHA-gated phishing accounted for only part of the malicious SVG activity. The resurgence was therefore broader than the use of SVG files to deliver that particular technique.

Business contact impersonation

Microsoft defines business contact impersonation (BCI) as a text-based attack targeting enterprise users that impersonates a trusted entity for the purpose of persuading a recipient into initiating a fraudulent financial transaction or sending the attacker sensitive documents.

BCI volume declined throughout Q3, totaling approximately 6.2 million attacks. That was substantially below Q2, although the comparison is influenced by the unusually large spike in April. By September, monthly activity had fallen to its lowest level since at least July 2025.

Figure 10. Monthly BCI attack volume (January – September 2026)

The reduction in overall volume also concealed differences among financial lures. Generic messages continued to dominate initial BCI contact during Q3, but explicit task and financial requests gained share as overall attack volume declined:

• Generic outreach messages, such as “Are you at your desk?”, accounted for 82% of attacks in July and August before declining to 79% in September. Raw volume fell 14% across the quarter, reinforcing that operators still overwhelmingly favored establishing contact before introducing a fraudulent request.
• Generic task requests represented 8–10% of attacks during Q3, increasing from 9% in July to 10% in September despite a 9% decline in raw volume.

Within the smaller subset of explicit financial requests:

• Payroll update requests were the most common financial lure, accounting for 6% of attacks in July and August and 7% in September. Raw volume remained broadly stable at approximately 126,000–130,000 attacks per month.
• Invoice payment requests recovered from June’s low. Volume increased 34% in July, 25% in August, and 89% in September, more than tripling between June and September. Their share reached 3% in September, its highest level since March.
• Gift card requests remained at 2% of attacks each month, while raw volume declined 9% from July to September.

Figure 11. Initial BCI email content by type (Q3 2026)

The decline in BCI overall did not extend equally to the requests reaching payment and payroll staff.

Microsoft Teams threats

Microsoft observed approximately 141,000 malicious Teams call attempts during Q3. Activity peaked in July before declining 31% by September, although September volume remained 38% above the monthly average for the first half of 2026. Teams-based attacks continued to use live interactions across chat, voice, screen sharing, and remote-support tools to facilitate remote access, credential theft, and hands-on-keyboard compromise.

Figure 12. Monthly observed malicious Microsoft Teams calls (January – September 2026)

Attackers increasingly moved away from display names that explicitly announced an IT- or tech-related support role. Ordinary personal-name display names rose from 46% of the observed July sample to 88% in September, while explicit help desk identities fell from 17% to 2%.

Figure 13. Malicious Teams call impersonation comparison (Q3 2026)

This shift does not necessarily mean attackers abandoned IT support stories. A personal name can accompany a claim to work for the help desk, while the underlying account address retains technical or service-related wording. More targeted attempts also used domains resembling the intended victim organization’s domain, emphasizing that the visible name is only one part of the impersonation.

Voice phishing attempts peaked in July and then receded, but September volume remained above the levels observed early in 2026. Calls were concentrated during recipients’ weekday working hours, when a live response was more likely. These attempts included unanswered, rejected, and short-lived calls, partly reflecting Microsoft’s expanding visibility and ongoing efforts to strengthen protective measures against social engineering abuse. Attemps should not be interpreted as successful attacker interactions.

Notable phishing campaigns

The following campaigns were observed during the quarter and highlight notable credential phishing, BCI, and malware delivery activity. For analysis of a separate Teams-based IT-support impersonation campaign observed in August, see Impersonating IT support: Threat actors turn remote session into enterprise-wide access.

Salary review lure delivers personalized QR code attachment for device code credential capture targeting legal organizations

On August 19, 2026, Microsoft Defender Research observed a phishing campaign targeting more than 10,000 users across more than 4,800 organizations, almost exclusively located in the United States. While most phishing attacks typically don’t focus on a single vertical, this campaign targeted the professional services sector, specifically law firms and legal organizations. Messages in this campaign were sent out over a 13-hour period between 13:27 UTC on August 19, 2026, and 2:59 UTC on August 20, 2026.

Figure 14. Intended campaign targets by industry

Emails in this campaign were sent with the subject line “Salary Review” from smtp[@]wekash[.]net via Amazon Simple Email Service. The email body carried no visible text and the sole payload was a Word document attachment named Your-Q3-Compensation-Summary.docx.

Figure 15. Sample of the campaign document attachment

The Word document impersonated the recipient’s own organization, displaying company branding and addressing the recipient by name. The message claimed that the recipient’s compensation had been revised following a Q2 performance review and that updated details were ready for review. A QR code in the document carried an instruction to scan it to access the revised details. This approach moved the phishing URL out of the email body and into an image, bypassing email gateway controls that scan text-based links but do not decode QR code images.

Scanning the QR code would have directed users to an attacker-controlled phishing page impersonating a Microsoft OneDrive sign-in portal hosted on the domain splace[.]co[.]za. The page presented an alphanumeric code and instructed recipients to copy it and proceed to the Microsoft sign-in portal.

Figure 16. Sample phishing landing page

The phishing page used a device code phishing technique, which works by making an authentication request to Microsoft’s device authentication service before the recipient arrived, receiving a user code in return, and embedding that code into the page. When a recipient copied the code and proceeded, the page redirected them to the legitimate Microsoft device authentication portal at microsoft.com/devicelogin, where they entered the code and signed in. Completing that sign in would have transferred a valid session token to the attacker. The token granted persistent access to the recipient’s Microsoft 365 account without ever exposing the password and without re-triggering multifactor authentication (MFA). A countdown timer on the page signaled that each code had a limited validity window, pressing recipients to act quickly.

Spanish-language purchase order and payroll campaign leads to Agent Tesla malware

On September 21, 2026, Microsoft Defender Research observed a phishing campaign targeting more than 56,000 users across more than 8,100 organizations. The campaign primarily targeted users in Spanish-speaking countries, with Colombia accounting for the largest share of intended recipients (15%), followed by the United States (12%), Mexico (12%), Chile (11%), and Spain (8%). Like most large-scale phishing attacks, this campaign did not focus on a single vertical, but instead targeted a broad range of industries, most notably retail and consumer goods (27%), manufacturing and agriculture (19%), and financial services (13%). Messages in this campaign were sent out over an almost nine-hour period between 14:57 UTC and 23:35 UTC on September 21, 2026.

Figure 17. Timeline of campaign message volume

Two lure variations were observed throughout the duration of the campaign: a purchase order theme, which was used in 63% of messages, and a payroll theme, which was used in the remaining 37%. Both variations were sent from the address contacto06[@]carloxmextos[.]org. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) all passed for that domain, so the messages did not depend on simple address forgery. The actor changed the display name to resemble a sales or human resources identity associated with the recipient’s organization. That combination gave the messages technically valid authentication while using the visible sender identity and familiar business context to support the impersonation.

The purchase order lure variation used the reply-style subject “Re: solicitud de cotización”. Its body said, “Buen Dia”, claimed that a purchase order was attached, and asked the recipient to confirm receipt before closing with the lowercase “saludos”. The abrupt wording, inconsistent capitalization, and copied professional signature made the message look like a short continuation of an existing commercial exchange while avoiding details that a recipient could easily challenge.

The attached file, Nuevo orden de compra – 21092026.pdf.uu, was a RAR archive despite its uncommon .uu ending and PDF-like name. Inside it was Nuevo orden de compra – 21092026.pdf.js, a JavaScript downloader whose second extension exposed the executable script type only after extraction. If run, the script fetched a file named Lincoln.ps1 from a campaign-controlled object in Firebase Storage, and that PowerShell payload led to Agent Tesla malware. The nested archive and misleading extensions separated the visible business document theme from the code that executed, while the cloud-hosted download gave the actor a remotely accessible staging point.

Figure 18. Redacted rendering of the purchase order lure email

The payroll-themed lure used the subject “Nomina 21.09.2026”. It addressed the recipient by name, said the September 21 payroll list was attached, and signed off as a human resources manager. The date-specific payroll pretext created an immediate work-related reason to open the file, while the personalized greeting made a bulk message appear locally relevant.

The payroll lure’s attachment, Nomina 21.09.2026.xml.001, was also a RAR archive. Extraction produced Nomina 21.09.2026.xml.exe, an Agent Tesla executable disguised with an XML-themed double extension. Unlike the purchase order delivery chain, this branch did not require a separate downloader in the supplied evidence, but both paths used the same sender infrastructure, attachment camouflage, date, and malware family. Agent Tesla is commonly used to collect credentials and other information from an infected host, so the shared final payload suggested that credential and information theft were the campaign’s likely objective.

Figure 19. Redacted rendering of the payroll lure email

Defending against email and collaboration threats

Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.

• Microsoft helps organizations reduce the risk of phishing and social engineering in Teams through user awareness and layered, built-in protections. Users should exercise caution with external connection requests and messages, including verifying a sender’s identity and requests before acting on them. Administrators can also block external Teams users and specify which users in their organization are permitted to chat or meet with people outside the enterprise. These flexible controls help organizations manage risk for employees in sensitive roles and departments. Teams will also be introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, particularly first-contact chats with external users. Together, these measures help organizations collaborate more securely in Teams.
• Review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to ensure your organization has established essential defenses and knows how to monitor and respond to threat activity.
• Invest in user awareness training and phishing simulations. Attack simulation training in Microsoft Defender for Office 365, which also includes simulating phishing messages in Microsoft Teams, is one approach to running realistic attack scenarios in your organization.
• Enable Zero-hour auto purge (ZAP) in Defender for Office 365 to quarantine sent mail in response to newly acquired threat intelligence and retroactively neutralize malicious phishing, spam, or malware messages that have already been delivered to mailboxes.
• Responders can also manually check for and purge unwanted emails containing URLs and/or Subject fields that are similar, but not identical, to those of known bad messages. Investigate malicious email that was delivered in Microsoft 365 and use Threat Explorer to find and delete phishing emails.
• Turn on Safe Links and Safe Attachments in Microsoft Defender for Office 365.
• Enable network protection in Microsoft Defender for Endpoint.
• Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware.
• Enable passwordless authentication methods (for example, Windows Hello, FIDO keys, or Microsoft Authenticator) for accounts that support passwordless. For accounts that still require passwords, use authenticator apps like Microsoft Authenticator for MFA. Refer to this article for the different authentication methods and features.
  • Conditional access policies can also be scoped to strengthen privileged accounts with phishing-resistant MFA.
• Configure automatic attack disruption in Microsoft Defender XDR. Automatic attack disruption is designed to contain attacks in progress, limit the impact on an organization’s assets, and provide more time for security teams to remediate the attack fully.

Microsoft Defender detections

Microsoft Defender customers can refer to the list of applicable detections below. Microsoft Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.

Microsoft Defender for Endpoint

The following alert might indicate threat activity associated with this threat. The alert, however, can be triggered by unrelated threat activity.

• Suspicious activity likely indicative of a connection to an adversary-in-the-middle (AiTM) phishing site

Microsoft Defender for Office 365

The following alerts might indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity.

• A potentially malicious URL click was detected
• A user clicked through to a potentially malicious URL
• Suspicious email sending patterns detected
• Email messages containing malicious URL removed after delivery
• Email messages removed after delivery
• Email reported by user as malware or phish

Microsoft Security Copilot

Microsoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries, hunting queries, and incident reports.

Customers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform security tasks efficiently:

• Threat Intelligence Briefing agent
• Phishing Triage agent
• Threat Hunting agent
• Dynamic Threat Detection agent

Security Copilot is also available as a standalone experience where customers can perform specific security-related tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers developer scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security needs.

Threat intelligence reports

Microsoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the activity and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.

• Activity Profile: Email threat landscape, September 2026
• Activity Profile: Email threat landscape, August 2026
• Activity Profile: Email threat landscape, July 2026
• Tool Profile: Tycoon2FA
• Actor Profile: Storm-1747
• Technique Profile: QR code phishing
• Technique Profile: ClickFix technique leverages clipboard to run malicious commands
• Threat Overview Profile: Business email compromise
• Threat Overview Profile: Adversary-in-the-middle credential phishing
• Activity Profile: Salary review lure delivers personalized QR code attachment for device code credential capture targeting legal organizations
• Activity Profile: Spanish-language purchase-order and payroll campaign leads to Agent Tesla malware

Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.

Hunting queries

Microsoft Defender XDR

Microsoft Defender XDR customers can run the following advanced hunting queries to find related activity in their networks:

Salary review campaign emails by sender address

The following query identifies emails associated with the August 19 campaign using a message’s sending email address.

EmailEvents
| where SenderMailFromAddress == “smtp@wekash.net”

Spanish-language purchase order and payroll campaign emails by sender address

The following query identifies emails associated with the September 21 campaign using a message’s sending email address.

EmailEvents 
| where SenderMailFromAddress == "contacto06@carloxmextos.org"

Indicators of compromise (IOCs)

Indicator	Type	Description	First seen	Last seen
wekash[.]net	Domain	Sender domain used to distribute campaign emails via Amazon SES	2026-08-19	2026-08-20
smtp@wekash[.]net	Email address	Sender email address observed in campaign messages	2026-08-19	2026-08-20
Your-Q3-Compensation-Summary.docx	File name	Word document attachment carrying the compensation lure and QR code	2026-08-19	2026-08-20
splace[.]co[.]za	Domain	Domain hosting phishing content	2026-08-19	2026-08-20
https://splace[.]co[.]za/0987643345678908765421234567890987654320987654321223456787654/onedrive/	URL	URL hosting phishing content	2026-08-19	2026-08-20
carloxmextos[.]org	Domain	Authenticated domain used to send both campaign variations	2026-09-21	2026-09-21
contacto06@carloxmextos[.]org	Email address	Sender address used for both observed lure variations	2026-09-21	2026-09-21
Nuevo orden de compra – 21092026.pdf.uu	File name	RAR attachment used in the purchase order variation	2026-09-21	2026-09-21
Nuevo orden de compra – 21092026.pdf.js	File name	JavaScript downloader contained in the purchase order archive	2026-09-21	2026-09-21
Lincoln.ps1	File name	PowerShell payload downloaded by the purchase order branch	2026-09-21	2026-09-21
Nomina 21.09.2026.xml.001	File name	RAR attachment used in the payroll variation	2026-09-21	2026-09-21
Nomina 21.09.2026.xml.exe	File name	Agent Tesla executable contained in the payroll archive	2026-09-21	2026-09-21
BEDD2297739632DA8EE470367295FE976E55BE74D628DCAEE7FA98121EE530F1	SHA-256	SHA-256 of the purchase order RAR attachment	2026-09-21	2026-09-21
CE832350C165522DB03DB040CA07917976D1A91F97E7016EA36DCC6B53E0EB13	SHA-256	SHA-256 of the JavaScript downloader	2026-09-21	2026-09-21
F8B49891D15A578E4DE28FECF99D0D78DB6B2C3DA81CD51C931B8D128E60C187	SHA-256	SHA-256 of the PowerShell payload associated with Agent Tesla delivery	2026-09-21	2026-09-21
C438B9A3BB67E2C10EFF0D01513422DC17DCE7C5508303A680E46F3DCEC886EF	SHA-256	SHA-256 of the payroll RAR attachment	2026-09-21	2026-09-21
72966B30BBD87E42C683D2AC7A42BB62021FC14389D508551432FFD70D62F33A	SHA-256	SHA-256 of the Agent Tesla executable from the payroll variation	2026-09-21	2026-09-21

Learn more

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

The post Email threat landscape: Q3 2026 trends and insights appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/f47VUhC
via IFTTT

Docker + ActiveState Extending Secure Defaults to the Packages Developers Install

Trusted content is the foundation security-conscious organizations expect all builds to start from. Docker has made that possible for everyone by providing the foundation free. Docker Hardened Images (DHI) are open source under Apache 2.0, with a catalog of 4,000+ minimal images (and growing) built from source and continuously maintained by Docker. The catalog also carries customizable Helm charts and over 65,000 hardened system packages. For most services, adopting DHI is as simple as changing the FROM line.

Teams building on a secure foundation now want the same assurance for the open source their applications install. That open source is a different layer of the supply chain, where thousands of upstream projects are pulled in at build time by pip, npm and Maven, and by coding agents as well.

Docker is committed to one standard for trusted content across everything teams build on. A new partnership with ActiveState, the company that has been securing open source since 1997, extends that standard to the packages themselves. Together, we give teams the same assurance on both layers, from the hardened images Docker maintains to the packages developers and their agents install on them. Once configured, the integration allows developers and AI coding assistants to continue using familiar package managers and development workflows, while approved dependencies are sourced through governed repositories rather than directly from public registries.

A hardened foundation removes a class of security work before code is written

Most applications still start from a large, generic base image, and the cost of that choice keeps growing. A large image increases the attack surface and accumulates stale dependencies, and the CVEs it generates land on developers long after the image was chosen. By removing unnecessary packages, rebuilding components from source and continuously maintaining the image, Docker Hardened Images reduce the vulnerabilities inherited from the container foundation. Images can achieve near-zero known CVEs, which means less remediation work and less scanner noise before application code is introduced. The hardening and patching are handled once in the foundation, for every service that builds on it.

Key takeaways

• When the TeamPCP campaign weaponized a widely trusted security scanner in March, Docker Hardened Images were not affected. DHI’s controlled build pipeline and dependency cooldown periods helped prevent compromised upstream artifacts from entering the image build process during the attack window.

Without trusted content on both layers, your team inherits the risk

Above the base image sit the dependencies an application brings with it. DHI secures the operating system packages and the language runtime that ship in the image. The application’s own libraries are pulled in at build time by its package managers from public registries, where trust is assumed and seldom verified. That layer needs what the image now has, a source that admits only the versions a team has approved and stands behind the fix when one of them needs it. Coding agents now pull those packages too. As Mark Lechner, CISO wrote in April, a compromised dependency pulled by an agent has the same blast radius as a compromised developer machine.

This year’s supply chain incidents have followed one pattern. As Lechner documented, attackers steal developer credentials, use them to poison trusted packages, and the compromised packages steal more credentials. The axios compromise earlier this year put two backdoored versions of a library downloaded 83 million times a week into circulation for about three hours. Most of these attacks burn out within hours. A build that resolves fresh from a public registry, with no lockfile or cooldown in front of it, has nothing between it and a version published an hour ago. The slower failure is the vulnerability that surfaces in one of those libraries months later, when no one outside the team is accountable for the fix. Either way, without trusted content on both layers, the risk lands on your team.

One standard for trusted content, from the image to the packages built on it

Docker Hardened Images are the foundation, and Docker stands behind them. Each image ships with a signed SBOM and SLSA Build Level 3 provenance, with full, unsuppressed CVE visibility. A security team can see what is in the image and how it was built. For teams that need remediation on a predictable clock, DHI adds a 7-day SLA on critical and high CVEs, FIPS and STIG variants, and secure customization on its paid tiers.

While DHI secures the image, ActiveState hardens the open source built on it. ActiveState provides the Curated Catalog, a private, policy-governed repository of open source components that security teams curate and developers and AI coding assistants consume safely. The catalog holds only the packages a team has approved. ActiveState compiles every component from original source code in a SLSA Level 3 environment with full provenance and complete SBOMs, in place of pre-compiled binaries from a public registry. When a fix becomes available upstream, ActiveState rebuilds the component and publishes it to the catalog automatically under SLAs of 5 business days for critical CVEs and 10 for highs.

With DHI and the Curated Catalog together, both layers carry provenance, SBOMs and a remediation SLA from the hardened image to the packages built on it. That gives security teams a consistent evidence trail across the software supply chain. The artifact repository teams already run, Artifactory or Nexus, points at the Curated Catalog as its upstream the way it points at PyPI today. Developers keep the same pip and npm workflow, and coding agents are served the governed version. None of this replaces the pinned digests, cooldown periods and sandboxed agents Lechner recommends. It gives those controls a governed source to point at.

The agentic era demands trusted content at every layer

AI coding agents are changing how quickly organizations create software. They can generate applications, select dependencies and initiate builds at a pace that traditional security review processes were never designed to support. Still, faster development should not mean blindly accepting more supply chain risk. Docker Hardened Images reduce the security burden of maintaining container foundations. ActiveState’s Curated Catalog extends governance and managed vulnerability remediation to the open source libraries those applications depend on. The result is a more consistent approach to software supply chain security, with trusted foundations, governed dependencies, verifiable build evidence and clear remediation responsibilities.

The goal is not to add another security checkpoint that causes friction in your build process. It is to make the secure path the easiest path for developers, platform teams and AI coding agents alike.

Security scales when the defaults are strong and the foundation is maintained by a team accountable for it. In an increasingly agent-driven development environment, the security of what gets built depends heavily on the trustworthiness of what those agents are allowed to consume. Docker now resells the ActiveState Curated Catalog alongside DHI, and ActiveState resells DHI to its customers. The hardened image and the packages built on it are both available through Docker.

from Docker https://ift.tt/cA4KzWh
via IFTTT

ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a great match.

The stranger part is how little some attacks now need. Ransom demands without encrypted files. Fake websites that look real enough to steal money. AI tools picking up dangerous instructions while trying to help. Even the attackers are making mistakes in their own code.

This week's stories are a reminder that the biggest problems don't always come from clever tricks. Sometimes the easy way works just fine. Here's what else happened.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

1. AI Accelerates Zero-Day Discovery

   The U.K. National Cyber Security Center (NCSC) has warned that the widespread availability of AI-powered cyber tools has "almost certainly" led to a significant increase in the discovery of zero-day vulnerabilities. "Defensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an n-day vulnerability, and have made patching a quicker process," NCSC said. "However, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. Additionally, an organisation’s internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery. Attackers have subsequently displayed less caution over losing an access to achieve an objective, as the cost to replace is minimal."

2. Critical Systems Face Prolonged Exposure

   An analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 has found that the median time to patch a vulnerability exceeds a year for network appliances. About 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. "The median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers," Microsoft said. "It stretches to 10+ weeks on Linux Servers and for applications running on macOS, and beyond a year on network appliances. That gap is the threat actor's window, widest on the critical systems that stay exposed the longest." The tech giant also said threat actors disproportionately target flaws that maximize impact and exposure and enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.

3. $4.5 Million Fraud Network Busted

   Authorities have arrested seven people allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, according to Europol. The operation caused estimated losses of at least $4.5 million. The "crime-as-a-service" offering was run by a company from Cyprus and Israel, and allegedly provided cybercrime groups with an assortment of trading websites and fraudulent call centers tasked with tricking victims into transferring their savings. These call centers operated from Albania, Kosovo, and North Macedonia. "More than 100 servers were seized and seven suspects arrested during coordinated action on 3 November 2026," Europol said. "Authorities searched 17 locations and seized servers, other evidence and assets." Like other fraudulent investment schemes, the operation leveraged deceptive advertisements to funnel people towards fraudulent investment platforms, promising them substantial, quick returns from cryptocurrency trading and foreign currencies. Although victims were encouraged to transfer a small amount, they displayed illusory gains to push them into transferring increasingly large sums. The operators resorted to delaying tactics to block payments when they attempted to withdraw their funds. "Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more," Europol said. "Personal data collected through this process was sold to criminal groups operating call centers. Operators then contacted potential victims with supposed investment opportunities, turning their initial interest into repeated demands for money."

4. $250K Bounty for Critical Cloud Flaws

   Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws, allowing researchers to earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. "To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup," Google said. "Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."

5. Edge Blocks Scam Notification Abuse

   Microsoft has announced that its Edge browser will now automatically disable notifications from sites that push scam or scareware notifications, such as fake virus warnings or security alerts. "As of last month’s rollout of Edge 156, when Microsoft Defender SmartScreen or Scareware blocker detects a scam that was pushed through a notification, Edge will automatically disable notifications from the site that sent it," Microsoft said. "The next time Edge starts, an information bar explains what happened. If you believe a site was blocked incorrectly, you can review sites with blocked notifications and unblock them from Edge Settings, keeping you in control."

6. University Cryptojacking Charges

   Two Canadian men, Ryan James Roach, 35, and Mathiew James Stubbings, 41, have been indicted in the U.S. for hacking multiple U.S. universities and using the access to mine cryptocurrency. Both have been charged with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, which carry a maximum penalty of 10 years in prison and a $250,000 fine. "Between June 2016, and December 2019, Roach and Stubbings conspired to engage in a scheme to hack into computers, steal login credentials, and secretly mine cryptocurrency for financial gain," the Justice Department said. "They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials. Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts."

7. Ransomware Extortion Without Encryption

   Cybersecurity researchers have detailed an encryptionless extortion attack involving PAYLOAD ransomware targeting a manufacturing organization in the Middle East. "The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root," Kaspersky said. "Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was a PAYLOAD sample targeting ESXi on Linux servers." The attack represents a convergence of two trends: Living-off-the-land abuse of trusted AD infrastructure and a surge in extortion-only incidents.

8. AI Sandbox Escape Exposes Sensitive Files

   A vulnerability impacting Docker Sandboxes (CVE-2026-103916) could have been exploited to bypass file access restrictions, potentially exposing cloud credentials and other sensitive files on a developer's machine through a routine copy command. "The command used to copy files between a sandbox and the developer's computer (sbx cp) does not enforce these access restrictions," Endor Labs said. "An agent can exploit this weakness using what is known as a symbolic link, essentially a shortcut that points to another file or folder. By placing a malicious shortcut inside an approved workspace, the agent can trick a subsequent copy command into accessing files outside the sandbox's approved boundaries." The issue has been addressed in Docker Sandboxes version 0.51.0.

9. Smart TVs Keep Tracking After Opt-Out

   Does Opting Out of ACR Work?

   A new study has revealed that smart TVs running operating systems from Samsung, Vizio, and Roku continue to transmit data to automatic content recognition (ACR) endpoints even after users opt out of tracking in the devices' settings. "Opting out fully worked on only four operating systems. On Samsung and Vizio, traffic consistent with ACR kept flowing, and Roku's opt-out doesn't cover its own streaming service," according to a group of academics from Northeastern University. "VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it."

10. Cryptographic Proof for AI Outputs

    Anthropic has revealed that it's working on an open-source system called FlashProve to cryptographically verify an AI response came from a given model. "FlashProve is a system for provable inference of large Mixture-of-Experts (MoE) language models," Anthropic said. "FlashProve involves two parties: the model provider (the prover) and a user (the verifier). It is split into two phases: In the offline phase, the prover publishes a commitment to the model weights, which is a short fingerprint to pin down one exact choice of weights while the weights themselves remain hidden. The later inference claims will be checked against that commitment, i.e., the weight model committed to in this phase. In the online phase, upon requests from the verifier (i.e., prompts and the corresponding output tokens), the prover produces a proof file proving the following statement: The committed model produces these output tokens when evaluated. Anyone who holds the commitment, the prompt, and the reply can check it, without the weights and with limited compute power, and be convinced that the committed weights, run on this prompt, produce exactly these tokens."

11. FTP and Webmail Credentials Exposed

    DreamHost has warned of a data breach after an unauthorized third party gained access to the server that runs its web-based File Manager at files.dreamhost.com between August and October 23, 2026. "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026," the company said. "The unauthorized third party was also able to reach certain webmail systems, which may have exposed the session information (the data that keeps a user signed in, including session credentials) of a limited number of webmail users. We believe this was a deliberate attack, and our team worked around the clock to contain it." DreamHost said the attacker may have accessed the credentials used to access the File Manager or webmail, along with the contents of emails and files in the FTP/SFTP server. There is no evidence that the attacker accessed control panel login information or customer billing details.

12. Pre-Auth RCE and Account Takeover

    The maintainers of Apache OFBiz have addressed 46 security flaws, including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation. The issues have been patched in Apache OFBiz 24.09.08.

13. Ransomware Encryption Flaws Exposed

    Cybersecurity researchers have uncovered encryption weaknesses in the updated HYFLOCK ransomware builds. The ransomware operation began to publicly name victims in October 2026, although evidence indicates that the group first appeared in underground forums in March 2026. As of writing, the group has listed 13 victims. "The October 17 build successfully encrypted files, registered a scheduled task, accessed network-share resources, and attempted to interfere with system recovery," Check Point said. "In an earlier October version, researchers identified a processing defect that could permanently discard portions of a file, potentially preventing complete recovery even with the correct decryption key. The October 17 build exhibited another issue. Larger files had only their first 4,096 bytes encrypted, leaving additional content accessible beyond that initial section."

14. Customer Identity Data Accessed

    DigiCert said it has identified an event involving unauthorized access to one of its business systems that stores information shared by customer representatives to validate their identity. The company said its certificate operations were not impacted. "Most of the data was limited to business contact information for customers: names, business email addresses, phone numbers, and business addresses," DigiCert said. "A small minority of customer accounts included additional personal data in the form of a customer-provided document such as a driver's license, passport, utility bill, or other document with name and address. The access could not write records, act as a validation approver, or issue certificates."

15. DeFi Hijack Drains $138K

    Threat actors have hijacked a little over a dozen DeFi websites registered with Name.com, including Flap, Kintsu, Pickle Finance and Origami Finance, ultimately stealing about $138,000 in assets. The sites have been found to be rigged with a malware kit that tricks visitors into approving transfers out of their wallets once they connect them to the compromised site. Vercel said it's aware of nine domains associated with the platform that were impacted. "Over about 45 minutes on Oct 31 (UTC), an account within an associated support team made changes to the nameservers associated with 15 domains registered with name.com," Name.com said in a post-mortem. "The domains were directed to a malicious page hosting Step Drainer malware."

16. Stolen Cloud App Credentials Abused

    Todyl has disclosed that an unknown threat actor has been abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to access MSPs' Microsoft 365 and Azure environments, reaching at least 27 organizations. "About 45 app registrations at roughly 18 organizations were targeted, and more than 33 of them authenticated successfully," Todyl said. "Through those apps the actor has reached 27 organizations so far, including the MSPs' downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits. It has run searches across about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items." The sign-in activity has originated from the IP address 199.19.77[.]84.

17. Syrian Hacker Gets 42 Months

    Ahmad Umar Agha (aka Th3Pr0), a Syrian national tied to the Syrian Electronic Army (SEA), has been sentenced to 42 months in prison in the U.S. for his involvement in an expansive hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad regime between Aug 2011 and January 2014. "To spread the former Syrian government's propaganda, Agha hacked approximately 47 Western media entities, businesses, non-governmental organizations (NGOs), and U.S. and allied government entities," the Justice Department said. "In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average." Agha and his alleged accomplice, Firas Dardar, were first charged in June 2014. Dardar remains at large.

18. Malicious AI Search Results Steal Crypto

    A new piece of malware has been observed targeting AI agents creating cryptocurrency wallets. "A GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent searches for one, contains malware that gives an attacker remote control of the victim's machine, including the crypto wallets on it," AIR Security said. The activity has been codenamed SolanaCry. The attack builds upon the foundation of Web Hole, where an AI agent, in its quest for finding answers to a problem, can inadvertently run a command suggested by an attacker and perform malicious actions. "To get a payload into search results, an attacker has two options," AIR said. "The first is to build a site of their own and grow its reputation with SEO, backlinks, content, time, until the search engine treats it as relevant and trusted. Once it ranks, they change the content and drop in the payload. The second is easier: find dead sites that still show up as ranked results, and use those to deliver it."

19. Android Banking Malware Spreads

    Thousands of Android phones belonging to retail banking customers in the Middle East, Turkey, and Africa (META) region have been compromised with the Mirax trojan between March and September 2026, leading to estimated losses worth millions of U.S. dollars. "Where unauthorized international transfers were reported, funds were sent to accounts abroad, some of which are suspected to be mule accounts," Group-IB said. "The campaign uses dynamically generated package names and impersonates 'Google Play Services' to evade user suspicion and signature-based detection." Like most Android malware, Mirax is used to facilitate device takeover (DTO) fraud by abusing Android's accessibility services. "With it, the attacker is able to see and control the compromised device in real time: reading credentials, intercepting one-time codes, capturing the PIN to unlock the device later, opening a banking app and moving money out to newly added beneficiaries and mule accounts abroad," Group-IB said. Campaigns using Mirax have been attributed to Aquafina, a threat actor known to be active since March 16, 2026.

20. AI Model Bypasses Task Instructions

    Irregular's evaluation of Zhipu AI's open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench has found that the model "did not refuse any of the tested offensive tasks" and "repeatedly reached correct answers while violating explicit task instructions." The AI security company said these violations can be interpreted as a form of reward hacking. "Crediting the answer alone could mislead capability assessments and deployment decisions, while rewarding it during training could reinforce these instruction violations," it added.

One thing stands out this week: attackers don't always need to be smarter than the systems they're targeting. They just need to find what was missed, left open, or trusted a little too much. And with AI making some of that searching easier, the time between finding a problem and using it is getting shorter. Patching still matters, but so does checking whether the controls already in place actually work.

That's it for this week. Some of these problems have fixes. Others need a closer look at how people, tools, and systems are allowed to work together. The next big headache may not come from a new bug at all. It could be something that's been sitting there for years, waiting for someone to notice. See you next week.

from The Hacker News https://ift.tt/PQFLGqe
via IFTTT