# Microsoft Q3 2026 Email Threat Landscape: Device Code Phishing via QR Salary-Review Lures and Agent Tesla RAR Campaign

> Microsoft reports ~7.3 billion email-based threats in Q3 2026, including an Aug 19-20 salary-review campaign that used QR codes and device code phishing against Microsoft 365 accounts (10,000+ users, 4,800+ orgs) and a Sep 21 Spanish-language purchase-order/payroll campaign delivering Agent Tesla via misleading-extension RAR archives (56,000+ users, 8,100+ orgs). CAPTCHA-gated phishing rebounded and 94-96% of payload attacks aimed at credential theft.

- **Published:** 2026-11-05T17:01:21Z
- **Last reviewed:** 2026-11-05T17:01:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5331
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5331.png
- **ID:** TL-2026-5331
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Microsoft Threat Intelligence's Q3 2026 email threat landscape report (published 2026-11-05) describes roughly 7.3 billion email-based phishing threats between July and September 2026, with September alone near 3 billion (a 41% increase over August). Spoofed business-service messages totalled 129 million (41-46 million per month May-September), with DocuSign the most spoofed brand in September (29%). Microsoft noted that 63% of September spoofed messages that failed authentication and were identified as malicious still carried tenant- or user-level security overrides. Credential theft dominated: 94-96% of payload attacks led to phishing sites or fraudulent sign-in pages. HTML (26-32%), PDF (27-30%) and SVG (13-20%, surging to 10.1 million in August) were the main attachment types, while DOC/DOCX fell to roughly 3-5%.

Campaign 1 (2026-08-19 to 2026-08-20) used personalized 'Salary Review' lures, claiming a Q2 performance-based compensation revision and carrying company branding and recipient names. Mail was sent from smtp@wekash.net through Amazon SES, with the attachment Your-Q3-Compensation-Summary.docx containing a QR code to https://splace.co.za/0987643345678908765421234567890987654320987654321223456787654/onedrive/. The page walked victims through device code phishing: the victim copies an alphanumeric code into the legitimate Microsoft device login portal (microsoft.com/devicelogin), handing the attacker a session token without exposing the password or re-triggering MFA. It reached 10,000+ users in 4,800+ organizations, 72.1% professional services (primarily US legal), 22.5% technology/software and 5.4% other.

Campaign 2 (2026-09-21) was a Spanish-language purchase-order and payroll campaign against 56,000+ users in 8,100+ organizations (Colombia 15%, United States 12%, Mexico 12%, Chile 11%, Spain 8%; retail/consumer goods 27%, manufacturing/agriculture 19%, financial services 13%). Messages came from contacto06@carloxmextos.org, which passed SPF, DKIM and DMARC. Variation A ('Re: solicitud de cotizacion') delivered 'Nuevo orden de compra - 21092026.pdf.uu', a RAR archive with a misleading extension that contained a .pdf.js JavaScript file; that file downloaded Lincoln.ps1 from Firebase Storage, which in turn delivered Agent Tesla. Variation B ('Nomina 21.09.2026') delivered 'Nomina 21.09.2026.xml.001', a RAR archive containing 'Nomina 21.09.2026.xml.exe', an Agent Tesla executable. The lures were date-specific, used personalized greetings and impersonated an HR manager.

The report also documents wider trends: QR code phishing fell to 12.1 million in Q3 (67% below Q2, 86% below the March 2026 peak of 28.3 million by September); CAPTCHA-gated phishing rebounded to 3.1 million in September (double July's low) with SVG attachments the dominant delivery vehicle (17% July, 65% August, 49% September); business contact impersonation totalled 6.2 million; and 141,000 malicious Microsoft Teams call attempts were observed, shifting toward ordinary personal names (46% to 88%) and away from explicit IT/help desk identities (17% to 2%). Tycoon2FA-linked messages fell to 21,000 in July, 99.8% below the February baseline of 8.9 million, after the March 2026 disruption. Microsoft does not attribute either campaign to a named actor. Attribution is therefore Unknown. The BeaconBeagle API returned HTTP 502 for the wekash.net lookup, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1684.001 Impersonation
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1528 Steal Application Access Token
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1550.001 Application Access Token

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Agent Tesla Lure — Double-Extension Script Dropper and Misleading RAR Archive Execution (TL-2026-5331)** (`TL-2026-5331-SPL-001`)

Detects wscript/cscript launching a JavaScript file hidden behind a document double extension (e.g. 'Nuevo orden de compra – 21092026.pdf.js'), WinRAR/7-Zip opening misleading-extension RAR archives (.pdf.uu, .xml.001), and process command lines referencing the campaign lure names (Nomina 21.09.2026, Nuevo orden de compra, Your-Q3-Compensation-Summary). Covers the September 21 2026 Spanish-language Agent Tesla campaign delivery-to-execution step (user opens the archive and runs the extracted .pdf.js).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.007
- **Data sources:** sysmon:EventCode=1, index=sysmon, DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval ofn=lower(OriginalFileName), cmd=lower(CommandLine), parent=lower(ParentImage)
| eval wsh_double_ext=if(match(ofn,"^(wscript|cscript)[.]exe$") AND match(cmd,"[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)"),1,0)
| eval archive_lure=if(match(cmd,"[.](pdf|xml)[.](uu|001)") AND match(parent,"winrar|7zfm|7zg|explorer"),1,0)
| eval lure_name=if(match(cmd,"nuevo orden de compra|nomina 21[.]09[.]2026|your-q3-compensation-summary"),1,0)
| where wsh_double_ext=1 OR archive_lure=1 OR lure_name=1
| table _time host User Image CommandLine ParentImage ParentCommandLine Hashes wsh_double_ext archive_lure lure_name
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wscript.exe", "cscript.exe") and ProcessCommandLine matches regex @"(?i)[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)")
    or (FileName in~ ("winrar.exe", "7zfm.exe", "7zg.exe") and ProcessCommandLine matches regex @"(?i)[.](pdf|xml)[.](uu|001)")
    or ProcessCommandLine matches regex @"(?i)nuevo orden de compra|nomina 21[.]09[.]2026|your-q3-compensation-summary"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Double-Extension Script Dropper or Lure Archive Execution (TL-2026-5331)
id: 3b9a6e52-71c4-4d08-9f1a-5c2e8d7b4a10
status: experimental
description: Detects wscript/cscript launching a script hidden behind a document double extension (.pdf.js) and WinRAR/7-Zip opening misleading-extension RAR archives (.pdf.uu, .xml.001) used in the September 2026 Agent Tesla campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.s0331
logsource:
  category: process_creation
  product: windows
detection:
  selection_wsh:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|re: '(?i)[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)'
  selection_archive:
    Image|endswith:
      - '\winrar.exe'
      - '\7zfm.exe'
      - '\7zg.exe'
    CommandLine|re: '(?i)[.](pdf|xml)[.](uu|001)'
  selection_lure:
    CommandLine|contains:
      - 'Nuevo orden de compra'
      - 'Nomina 21.09.2026'
      - 'Your-Q3-Compensation-Summary'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin scripts that use double extensions
  - Genuine split archives named *.001 opened with 7-Zip
level: high
```

**Known false positives:**

- Legitimate administrative scripts deliberately named with a document-style double extension
- Genuine multi-volume archives named *.001 opened in 7-Zip by IT staff

**Tuning notes:** Change index=sysmon to the index holding your Sysmon operational log. Restrict the wsh_double_ext branch to user-writable paths if script hosts are heavily used by admins, and add an exclusion for known signed IT automation. Keep lure_name as a short-lived IOC branch and expire it after the campaign window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phishing Email Delivery — Campaign Senders, Lure Subjects, Misleading Archives and Landing Domains (TL-2026-5331) (locked: unlock with TL Creds)
- Agent Tesla Executable — Campaign Hashes and Double-Extension .exe Run from Archive or Temp Paths (TL-2026-5331) (locked: unlock with TL Creds)
- Agent Tesla SMTP/FTP Exfiltration from User-Writable Process Paths (TL-2026-5331) (locked: unlock with TL Creds)
- Entra ID Device Code Flow Sign-In — Salary Review QR Device Code Phishing (TL-2026-5331) (locked: unlock with TL Creds)
- Browser Credential Store Access by Non-Browser Process in User-Writable Path (TL-2026-5331) (locked: unlock with TL Creds)
- Script Host or PowerShell Resolving Firebase Storage Payload Host (TL-2026-5331) (locked: unlock with TL Creds)
- Script Host Spawning PowerShell to Fetch [indicator] from Firebase Storage (TL-2026-5331) (locked: unlock with TL Creds)
- Endpoint DNS and Network Contact with Campaign Domains and Community-Observed Infrastructure (TL-2026-5331) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `wekash[.]net`
- File hash: `BEDD2297739632DA8EE470367295FE976E55BE74D628DCAEE7FA98121EE530F1`
- Domain: `splace[.]co[.]za`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Email threat landscape: Q3 2026 trends and insights](https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/)
- [Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign (Gurucul)](https://partner.gurucul.com/articles/ThreatResearch/Unmasking-Agent-Tesla-A-Deep-Dive-into-26-2-2026)
- [Campaign Analysis: Multi-stage delivery of Agent Tesla (Gurucul)](https://community.gurucul.com/articles/ThreatResearch/Campaign-Analysis-Multi-stage-delivery-15-7-2025)
- [H-ISAC TLP White Threat Bulletin: Storm-2372 conducts device code phishing campaign](https://www.aha.org/system/files/media/file/2025/02/h-isac-tlp-white-threat-bulletin-storm-2372-conducts-device-code-phishing-campaign--2-14-2025.pdf)
- [Storm-2372 used the device code phishing technique since August 2024](https://securityaffairs.com/174270/apt/storm-2372-used-device-code-phishing-technique.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5331