[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnAKvijG90JOh2rdrbYkUdwr0sQct2_rq7CphYSH5_e4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"d3884bdd-8aaf-4775-a7d4-558b71f42c41","phishing-surges-to-3-billion-monthly-detections-as-broad-email-exceptions-enable-bypass","0e597227-82ec-4356-8856-85c8b125a4ce","Phishing Surges to 3 Billion Monthly Detections as Broad Email Exceptions Enable Bypass","In Q3 2026, email-based phishing attacks surged 41% month-over-month, with attackers exploiting overly broad security exceptions that allowed malicious messages to bypass email filtering controls. Threat actors spoofed legitimate business service domains and used familiar social engineering lures — such as salary reviews and purchase orders — to harvest credentials and deliver malware like Agent Tesla. The resurgence of CAPTCHA-gated phishing highlights that attackers continuously adapt techniques to evade automated defences. This matters because credential theft at this scale provides adversaries with persistent access to corporate environments, enabling downstream attacks including ransomware, data exfiltration, and business email compromise.","**Immediate actions:**\n- Audit and tighten all email security exceptions, removing any broad allow-list entries that permit spoofed or unverified business-service domains.\n- Enable DMARC, DKIM, and SPF enforcement for all inbound and outbound mail flows to reject domain-spoofed messages at the gateway.\n\n**Long-term improvements:**\n- Deploy multi-factor authentication (MFA) across all user accounts so that stolen credentials alone cannot grant attacker access.\n- Establish a regular phishing simulation and security awareness training programme targeting lures specific to current threat trends (e.g., salary reviews, purchase orders).\n- Implement Zero Trust email access policies that evaluate message context, sender reputation, and link\u002Fattachment risk dynamically rather than relying on static exceptions.\n\n**Detection measures:**\n- Configure SIEM or email security platforms to alert on anomalous spikes in inbound message volume or new CAPTCHA-redirect URL patterns.\n- Integrate threat intelligence feeds covering newly registered or spoofed business-service domains to block emerging phishing infrastructure proactively.",[12,13,14,15,16,17,18],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32",{"GDPR Article 32":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Mass credential harvesting directly threatens personal data confidentiality; Article 32 requires organisations to implement appropriate technical measures — including effective email security controls — to protect personal data against foreseeable threats like phishing.","This technique directly describes the attack vector observed — adversaries sent spear-phishing emails with malicious lures to steal credentials and deliver Agent Tesla, making T1566 the foundational reference for detection and mitigation of this campaign.","Broad email security exceptions represent a misconfiguration flaw that allowed malicious mail to bypass controls; a formal remediation process requiring regular review and justification of exceptions would have closed this gap.","A 41% surge in phishing volume requires a prepared incident response capability to rapidly triage compromised accounts, revoke stolen credentials, and contain malware like Agent Tesla before it establishes persistence.","Users who receive salary-review and purchase-order lures are the last line of defence; structured, role-based phishing awareness training would reduce click rates and credential submission against these well-known social engineering themes.","The permissive email gateway exceptions constitute a known technical weakness; ISO 27001 requires organisations to identify, evaluate, and remediate such vulnerabilities on a timely basis to prevent exploitation.","Because credential theft was the dominant objective, enforcing MFA and strong identity controls under PR.AA would ensure that even successfully phished passwords cannot be weaponised for initial access.","published","2026-11-05T18:22:35.580699+00:00","2026-11-05T18:22:35.565+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F05\u002Femail-threat-landscape-q3-2026-trends-and-insights\u002F","email-threat-landscape-q3-2026-trends-and-insights-42dccc","Email threat landscape: Q3 2026 trends and insights",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":54,"name":55,"problem":56},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":58,"name":59,"problem":60},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]