8.3 Billion Phishing Emails: What Q1 2026 Means for Cybersecurity in Houston

QR code phishing (sometimes called "quishing") works because it bypasses the part of the email security stack that scans text and URLs. The malicious link lives inside an image, and the user scans it with a phone that is usually outside the company's managed defenses. By the time the credential prompt appears, the attack has moved to an unmanaged device.

Microsoft reported QR code attacks rose from 7.6 million in January to 18.7 million in March, a 146% jump in just three months. The delivery mix shifted too:

• PDF Attachments. Grew from 65% of QR code attacks in January to 70% in March. PDFs feel safe to most users and slip past basic attachment filters.
• DOC and DOCX Files. Volume kept climbing each month even as the share dropped from 31% to 24%.
• Email-Body QR Codes. The big surprise. Up 336% in March with no attachment at all, just an inline image. Still only 5% of total volume, but the growth rate is the warning sign.

For Houston firms in regulated industries, this matters more than it does for the average business. Healthcare practices around the Texas Medical Center, accounting firms preparing for tax season filings, and wealth management offices in The Galleria all handle data where a single credential compromise creates a regulatory event, not just an IT problem.

CAPTCHA-gated phishing is exactly what it sounds like. A user clicks a link, lands on a page that looks like a Cloudflare or Google security check, and clicks the box to prove they are human. The CAPTCHA is fake. Its job is to delay automated scanners that flag malicious destinations and to make the page feel legitimate before the credential prompt loads.

After declining in January (-45%) and February (-8%), the technique exploded in March to 11.9 million attacks, a 125% month-over-month increase and the highest single-month volume Microsoft has tracked. What is more telling is the rotation in delivery payloads:

• PDF Files. Quadrupled in March (+356%), beating their previous annual high by 37%.
• DOC and DOCX Files. Up 373% in March to claim 15% of payloads, after months of being a rounding error.
• HTML Attachments. Doubled in March, but ended the quarter as only the second-most common method.
• SVG Files. Spiked 49% in February, then fell 57% in March. Attackers are testing what evades filters.

The same report also noted that Tycoon2FA, a phishing-as-a-service platform Microsoft and Europol partially disrupted in early March, no longer dominates this space. Its share of CAPTCHA-gated infrastructure fell from over 75% at the end of 2025 to 41% in March. That sounds like good news. It is not. It means the technique is spreading across more kits and more actors, not concentrating in one. The disruption hurt one operator. The playbook proliferated.

Traditional malware delivery kept its long-term decline, accounting for only 5% to 6% of payloads by end of Q1. Credential phishing took the rest, and the shift in file types is worth a close look:

One campaign on March 17, 2026 sent 1.5 million malicious HTML messages to more than 179,000 organizations in 43 countries in a single day. The senders impersonated routine billing and document workflows. ACH alerts. Invoice statements. E-signature requests. The kind of subject lines that pass without a second glance in a busy back office.

If your team relies on perimeter filtering and a quarterly phishing test, that is not enough anymore. Houston businesses need layered cybersecurity protection that covers email, endpoint, identity, and user training as a single system.

Business email compromise (BEC) is a text-based attack that impersonates a trusted person to convince the recipient to wire money, send documents, or change a payroll detail. Microsoft counted approximately 10.7 million BEC attacks in Q1 2026, with March alone bringing in over 4 million. The composition tells you exactly how these attackers operate:

• Generic Outreach Messages. 82% to 84% of all initial contact. Things like "Are you at your desk?" or "Quick question, are you available?" The first email never asks for anything financial.
• Explicit Financial Requests. Only 9% to 10% of initial messages. The attacker waits for engagement first, then drops the ask.
• Payroll Update Requests. Up 15% in February to an eight-month high. Tax season timing was no accident.
• Gift Card Requests. Fell 37% in February, then jumped 108% in March. Still under 3% of overall volume, but the variance suggests attackers keep testing what works.

None of this requires enterprise-grade tooling. It requires the right configuration of tools most Houston SMBs already own, paired with consistent user training and a documented response process. The five highest-leverage actions:

• Move To Phishing-Resistant MFA. SMS codes and push approvals fall to adversary-in-the-middle attacks. FIDO2 keys and passkeys do not. Microsoft's report shows the AiTM kits are still the most effective credential-theft technique on the market.
• Block QR Code Renderings in Email PDFs. Modern email security platforms can extract and scan QR codes inside attachments. If yours cannot, that is a tooling gap worth addressing this quarter.
• Train Users on the "Are You at My Desk" Opener. Most BEC attempts start with a question, not an ask. Your team needs to recognize the pattern. Simulated phishing alone will not catch this; conversational simulations do.
• Turn On Safe Links and Safe Attachments. Microsoft Defender for Office 365 ships these features. Many Houston SMBs we audit have them turned off or scoped to the wrong groups.
• Document Your Wire Transfer Verification Process. A 60-second callback to a known phone number before any wire over $10,000 stops most BEC losses cold. Write the policy, train the finance team, and audit it twice a year.