Microsoft Reports Spike in AI‑Generated Phishing and Business Email Compromise in Q3 2026
What Happened — Microsoft’s Threat Intelligence team published its quarterly email‑threat landscape, noting a 27 % rise in credential‑phishing campaigns and a 42 % increase in Business Email Compromise (BEC) attempts compared with Q2 2026. Attackers are leveraging large‑language models to craft highly personalized spear‑phishing messages that bypass traditional keyword filters. The report also highlights a surge in “password‑spraying” attacks against cloud services and a growing reliance on compromised legitimate domains for malicious payload delivery. Microsoft observed that over 60 % of the malicious emails employed spoofed sender addresses that passed basic SPF/DKIM checks, making detection harder for conventional defenses.
Why It Matters for Trust & Control Assurance — The trend underscores the critical need for continuous security‑awareness training and simulated phishing exercises to keep user behavior in line with control objectives around people‑centric security.
Who Is Affected — Financial services, healthcare, technology SaaS providers, and any organization that relies on email for business communications.
Recommended Actions –
- Refresh phishing‑simulation programs with AI‑generated content to mirror current attacker tactics.
- Enforce multi‑factor authentication (MFA) and adopt DMARC, SPF, and DKIM enforcement across all outbound mail.
- Conduct quarterly security‑awareness training that includes BEC detection and response playbooks. Source: Microsoft Security Blog
Technical Notes – Primary vectors: AI‑crafted spear‑phishing, password‑spraying, domain spoofing. No specific CVEs were cited. Source: Microsoft Security Blog