Microsoft finds phishing surged in September, while security exceptions let malicious mail through

Microsoft says it detected nearly 3 billion email-based phishing threats in September, up 41% from August. Its Q3 threat report also highlights a less obvious weak point: some malicious messages spoofing trusted business services still reached organisations after security exceptions overrode protections.

Watch Desk analysis

What happened

Microsoft Threat Intelligence detected about 7.3 billion email-based phishing threats from July to September. The report describes changing tactics: CAPTCHA-gated phishing rose to 3.1 million attacks in September, nearly twice July’s low, while QR-code phishing fell 67% quarter on quarter.

The report says attackers spoofed tracked business-service domains in about 129 million malicious messages during Q3. In September, overrides applied to 63% of messages with a recorded security outcome. Microsoft says most of those overrides were configured at tenant level. The figures do not show that recipients opened the messages or that accounts were compromised.

Key findings

• Exceptions can blunt detection
  Microsoft says many spoofed messages identified as malicious were associated with tenant- or user-level overrides.
• Phishing methods shifted
  CAPTCHA-gated attacks recovered from July’s low, with SVG attachments prominent in the increase.
• QR-code attacks fell
  Microsoft detected about 12.1 million in Q3, down 67% from the previous quarter.
• Credential theft remained the main aim
  Microsoft says 94–96% of payload-based attacks directed people to phishing sites or fraudulent sign-in pages.

Why it matters

A security system can identify a threat and still be undermined by an exception meant to keep legitimate work moving. Microsoft’s findings make those rules worth checking alongside detection coverage, particularly where exceptions apply broadly to messages from business services.

The changing mix matters too. QR-code attacks declined, but that does not make phishing disappear: attackers used other routes, including CAPTCHA-gated pages and attachments. The sensible defensive posture is to review exceptions and keep checking how protections handle more than one delivery method.

Our read

The useful warning here is not that every exception is a mistake. It is that exceptions can become a quiet route around protections, while attack methods shift under everyone’s feet. Organisations should review who can create or approve overrides, how narrowly they are scoped and whether they still serve a real need. A trusted logo is not an authenticated sender, however familiar the workflow.

What to watch

• Whether Microsoft’s next report shows the September rise continuing.
• Whether organisations review tenant- and user-level exceptions for spoofed business-service mail.
• Whether SVG and CAPTCHA-gated phishing remain prominent as delivery tactics change.

Discussion spark: When a security exception keeps a legitimate workflow running, what should organisations require before allowing it to override protections?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.