Microsoft Logs 7.3B Phishing Threats as Siemens and Veeam Issue Fixes

Enterprise security operations teams are confronting a surge in third-quarter email phishing volume alongside newly disclosed authentication and kernel advisories from Siemens and Veeam. Microsoft Threat Intelligence reported detecting approximately 7.3 billion email-based phishing threats from July through September 2026, including a 41% monthly jump to nearly 3 billion threats in September alone.

While QR code phishing fell 67% from the second quarter to 12.1 million attacks (86% below its March peak, with PDF share dropping from 78% to 61% and Tycoon2FA volume down 99.8% from 8.9 million in February to 21,000 in July), SVG attachments increased sixfold in August to 10.1 million files. Across the quarter, 94% to 96% of malicious attachments targeted credential theft, with HTML and PDF files representing 56% to 62% of payloads. Microsoft also tracked 129 million malicious messages spoofing trusted business-service domains—averaging 41 million to 46 million monthly, led by DocuSign at 29% in September—where tenant- and user-level security overrides allowed delivery in 63% of recorded cases. Business contact impersonation totaled 6.2 million attacks (including 126,000 to 130,000 monthly payroll lures), while Microsoft observed 141,000 malicious Teams call attempts in Q3 as attackers shifted from explicit help desk titles (falling from 17% to 2%) to ordinary personal names (rising from 46% in July to 88% in September). Highlighted campaigns included an August 19 salary review lure targeting more than 10,000 users across 4,800 U.S. legal organizations over 13 hours, and a September 21 Spanish-language purchase order (63%) and payroll (37%) campaign delivering Agent Tesla malware to 56,000 users across 8,100 organizations.

In application security, the Cybersecurity and Infrastructure Security Agency (CISA) republished Siemens ProductCERT advisory SSA-137528 (ICSA-26-302-01) warning of an authentication bypass vulnerability in the Siemens Mendix SAML module. Tracked as CVE-2026-89209 (CWE-294) with a CVSS v3.1 base score of 6.8, the flaw allows unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response in identity-provider-initiated single sign-on flows. Siemens recommends disabling IdP-initiated SSO or updating Mendix 10 and Mendix 11 modules to version V4.2.4 or later and Mendix 9 modules to version V3.6.29 or later.

Meanwhile, Veeam warned enterprise administrators that Veeam Software Appliance version 13.1 and later virtual machines intermittently fail to boot on hosts powered by certain AMD EPYC processors, including the AMD EPYC 7262, 7302, and 7F72. During early boot, the underlying Linux kernel executes a cryptographic jitterentropy health test in FIPS mode that can fail with error code 9 and trigger a kernel panic. Veeam—whose software serves more than 550,000 customers, including 74% of Global 2,000 firms and 82% of Fortune 500 companies—advised administrators to redeploy affected appliances onto different processors, disable automatic updates, or power off and power on the virtual machine if a panic occurs, while also deploying patches for a critical Linux kernel Multipath TCP IPv4 vulnerability (CVE-2026-98432).