Microsoft observed real Q3 2026 phishing campaigns that used familiar workplace requests to steal credentials or deliver malware. One campaign targeted legal organizations with personalized salary-review documents containing QR codes, while another used purchase-order and payroll lures in disguised archives to deliver Agent Tesla. The report also shows that spoofed business-service messages can get through when broad security exceptions override protections.
Microsoft's Q3 2026 email threat data describes two real campaigns that used familiar workplace requests as lures. In August, a campaign targeting legal organizations sent personalized salary-review documents containing QR codes. Scanning the code moved recipients into a device-code phishing workflow, shifting the interaction from a managed work device to a personal phone. In September, a separate campaign used purchase-order and payroll lures with disguised archive attachments to deliver Agent Tesla, a credential-stealing malware family, to procurement, accounts payable, and payroll staff.
Both campaigns relied on routine business processes rather than unusual requests. A salary review and a purchase order are the kind of documents employees expect to receive, which reduced suspicion. The report also notes that spoofed messages from business-service sender domains, roughly 129 million in Q3, were often delivered despite failing authentication checks because organization or user-level security exceptions overrode existing protections. Familiar branding alone did not indicate a legitimate, authenticated sender.
Microsoft's data shows credential theft, not malware installation, was the main objective of most payload-based attacks in Q3: approximately 94-96% directed recipients to a phishing site or a fraudulent sign-in page. This means an attachment does not need to execute code to put an account at risk. Organizations in legal services, finance, and payroll functions can reduce exposure by:
These two campaigns, built around a salary review and a purchase order, show that attackers continue to find success by mimicking ordinary business communication rather than relying on urgency or unusual requests. Recognizing these patterns is central to reducing the success rate of similar lures (T1566.001, T1566.002).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
In August, attackers sent personalized salary-review documents containing QR codes to employees at legal organizations, leading recipients into a device-code phishing workflow when scanned.
In September, attackers used purchase-order and payroll lures with disguised archive attachments to deliver Agent Tesla, a credential-stealing malware family, to procurement, payroll, and finance staff.
Microsoft found that many of the roughly 129 million malicious messages spoofing business-service sender domains in Q3 failed authentication checks but were still delivered because of tenant- or user-level security exceptions.
No. Microsoft found that approximately 94-96% of payload-based attacks in Q3 directed recipients to a phishing site or a fraudulent sign-in page rather than installing software, so credential theft remained the primary goal.
“Your personalized salary review document is ready.” Tempting, right? In a campaign targeting legal organizations, that document contained a QR code. Scan it, and your phone opens a device-code sign-in you never started. That's the trick: a work email moves the sign-in to your personal phone. Another lure says, “Please review the attached purchase order”, but its archive can deliver Agent Tesla malware. Unexpected salary review or purchase order? Before scanning or opening anything, confirm it with your known HR or vendor contact.
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…
This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Attackers created fake GitHub repositories that copied the names of PS5 emulator projects, luring gamers searching for ways to play PS5 games on a PC. The ZIP downloads did not contain working emulators; they launched malware that evaded analysis, attempted to weaken Microsoft Defender protections,…
