Microsoft's Q3 report finds phishing attackers reviving old file tricks

Microsoft's Threat Intelligence team released its Email Threat Landscape report for the third quarter of 2026, documenting a surge in phishing attacks during the period. The report highlights that attackers are increasingly relying on HTML and PDF attachments to disguise malicious content, which can slip past some filters that focus on more obvious file types. Notably, the report also flags a revival of SVG image files as a payload method, a format that had largely fallen out of favor with attackers but is now being reused to deliver malicious code or links while appearing as an innocuous image. The findings reflect how phishing tactics continue to evolve as defenders adapt their filtering strategies, pushing attackers to cycle back through older techniques that are no longer as closely scrutinized. For security teams, the report is a reminder that file-type based defenses need to stay current, since attackers actively rotate through formats to evade detection.

Why it matters

A timely warning that old attack techniques, like SVG-based phishing, are being revived now that defenses have moved on.

Source: Microsoft