Email threat landscape: Q3 2026 trends and insights

Between July and September 2026, approximately 7.3 billion email-based phishing threats were detected, with a significant 41% increase in attacks in September compared to August. Attack techniques shifted notably, including a decline in QR code phishing and a resurgence of CAPTCHA-gated attacks using SVG attachments. Domain spoofing persisted, affecting 129 million messages impersonating business services. Credential theft remained the primary goal, while business contact impersonation declined. Teams-based phishing increasingly used common personal names instead of help desk identities. Targeted campaigns affected legal organizations and Spanish-speaking users, delivering Agent Tesla malware. The disruption of the Tycoon2FA phishing platform resulted in a 99.8% reduction in its phishing volume.

• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day ExploitsMalware2026-09-23
• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05