Between July and September 2026, approximately 7.3 billion email-based phishing threats were detected, with a significant 41% increase in attacks in September compared to August. Attack techniques shifted notably, including a decline in QR code phishing and a resurgence of CAPTCHA-gated attacks using SVG attachments. Domain spoofing persisted, affecting 129 million messages impersonating business services. Credential theft remained the primary goal, while business contact impersonation declined. Teams-based phishing increasingly used common personal names instead of help desk identities. Targeted campaigns affected legal organizations and Spanish-speaking users, delivering Agent Tesla malware. The disruption of the Tycoon2FA phishing platform resulted in a 99.8% reduction in its phishing volume.
