Microsoft says email-based phishing threats remained massive during the first quarter of 2026, with QR-code phishing and CAPTCHA-gated attacks emerging as some of the fastest-growing tactics used by cybercriminals.
According to Microsoft Threat Intelligence, the company detected approximately 8.3 billion phishing threats between January and March 2026. QR-code phishing attacks increased 146% during the quarter, while business email compromise (BEC) activity accounted for roughly 10.7 million attacks.
The findings were published in Microsoft’s latest email threat landscape report, which outlines how attackers are increasingly shifting toward link-based credential phishing campaigns, hosted phishing infrastructure, and evasion techniques designed to bypass automated detection systems.
Link-Based Phishing Dominates Email Threats
Microsoft said that approximately 78% of phishing attacks observed during the quarter relied on malicious links rather than traditional malware attachments.
Attackers increasingly used:
- fake Microsoft 365 login pages,
- cloud-hosted phishing infrastructure,
- shortened URLs,
- credential harvesting pages,
- and PDF-based lure documents.
The shift toward link-centric phishing reflects broader changes across the email threat landscape as adversaries attempt to avoid attachment-based scanning and endpoint detection systems.
Microsoft noted that many campaigns now rely on legitimate cloud services and trusted hosting providers to improve delivery success and reduce the likelihood of detection.
QR-Code Phishing Increased 146%
One of the most significant trends identified in the report was the rapid growth of QR-code phishing, often referred to as “quishing.”
Microsoft said QR phishing campaigns grew from approximately 7.6 million incidents to 18.7 million during the quarter, representing a 146% increase.
Rather than embedding malicious links directly in emails, attackers increasingly place QR codes inside:
- PDF attachments,
- Microsoft Office documents,
- fake MFA enrollment notices,
- voicemail notifications,
- and account security alerts.
Victims are then redirected to credential harvesting pages after scanning the code with mobile devices.
Microsoft said QR-code phishing is increasingly attractive to attackers because it can complicate automated scanning and security analysis workflows that traditionally focus on clickable URLs embedded directly inside messages.
The company also noted that QR phishing campaigns are becoming more polished and convincing, often impersonating enterprise login portals and cloud productivity platforms.
CAPTCHA-Gated Phishing Campaigns Continue to Grow
Microsoft also highlighted the increasing use of CAPTCHA-gated phishing sites.
In these campaigns, victims encounter a CAPTCHA verification screen before reaching the phishing page itself. According to Microsoft, the technique is increasingly being used as an evasion method against automated analysis and scanning systems.
The report said attackers are using CAPTCHA barriers to:
- prevent automated crawlers from analyzing phishing pages,
- reduce detection by security vendors,
- and increase the lifespan of malicious infrastructure.
Microsoft noted that CAPTCHA-gated phishing has become especially common among phishing-as-a-service operations and credential theft campaigns targeting Microsoft 365 users.
Business Email Compromise Remains Persistent
Despite growing attention around AI-generated phishing and advanced credential theft attacks, Microsoft said traditional business email compromise remains one of the most persistent threats affecting organizations.
The company observed roughly 10.7 million BEC-related attacks during the quarter.
These attacks commonly involved:
- executive impersonation,
- invoice fraud,
- vendor payment scams,
- payroll diversion attempts,
- and account impersonation.
Unlike mass phishing campaigns, many BEC attacks rely heavily on social engineering and carefully targeted messaging rather than malware delivery.
Microsoft also warned that attackers increasingly combine stolen credentials with legitimate email infrastructure, making malicious communications appear more trustworthy and harder to detect.
Tycoon2FA Infrastructure Disruption Reduced Activity
The report also discussed Microsoft-led disruption efforts targeting Tycoon2FA, a phishing-as-a-service platform associated with adversary-in-the-middle credential theft operations.
Tycoon2FA became widely used by cybercriminal groups because it enabled attackers to intercept credentials and authentication tokens while bypassing multi-factor authentication protections.
According to Microsoft, phishing activity associated with Tycoon2FA declined approximately 15% following infrastructure disruption efforts.
However, Microsoft cautioned that similar phishing frameworks continue to emerge and evolve across the cybercrime ecosystem.
Email Security Is Becoming More Complex
The findings reinforce a growing challenge across the email ecosystem: authenticated email does not automatically mean safe email.
Attackers increasingly abuse legitimate cloud infrastructure, trusted platforms, and sophisticated social engineering techniques to evade traditional security controls.
The report suggests mailbox providers, enterprise defenders, ESPs, and security vendors will continue investing heavily in:
- behavioral analysis,
- real-time threat intelligence,
- link reputation systems,
- identity protection,
- and advanced phishing detection technologies.
The report also arrives as mailbox providers continue tightening sender authentication and bulk email enforcement requirements throughout 2026.
As phishing campaigns become more advanced and infrastructure becomes easier to automate, the distinction between successful email delivery and actual message safety is becoming increasingly important across the broader email industry.
Source: Microsoft Security Blog
