Microsoft's annual report covers July 2025 to June 2026 and records more than 46 million business contact impersonation attacks.

 

What happened

Between 89% and 95% of email phishing attachments led to an attempt to steal credentials, according to the Microsoft Digital Defense Report 2026, published October 1 and covering the year through June 2026. Microsoft screens roughly 5.2 billion emails a day and processes more than 165 trillion security signals. It detected over 46 million business contact impersonation attacks over that period and more than 145 million QR code phishing attacks through its Office 365 protection alone. Data theft featured in 63% of intrusions. Among voice phishing attacks, 93% kept the victim on the line long enough for the social engineering to begin.

 

Going deeper

Most intrusions still begin with a person or a credential rather than a software flaw. User execution, meaning someone opening or running something, and valid accounts, meaning legitimate credentials in the wrong hands, remained the two most common ways attackers got in. Once inside, 52.2% of intrusions using valid accounts went on to involve further credential theft, so one compromised identity becomes the route to many more. Exposed cloud workloads were attacked within an average of 5.3 hours. Microsoft recorded a 15.8% year-on-year increase in ransomware detonations against enterprises, with ransomware reaching nearly every industry and imperative manufacturing taking the largest number of detections.

 

What was said

Attackers are "increasingly exploiting the trusted identities, systems, relationships, and services organizations rely on most," Microsoft wrote in the report's opening summary. Its assessment names identity as the primary control plane for defense, stating that phishing-resistant multifactor authentication and passkeys, disciplined identity hygiene, tiered administration, and strong privileged access enforcement remain the best safeguards, and that this control plane now covers applications and software agents as well as people.

 

In the know

A browser extension with more than 600,000 installations was harvesting conversation histories from ChatGPT and DeepSeek when Microsoft found it in December 2025, affecting close to 10,000 organizations before it was shut down, the report records. Microsoft notes that conversation histories now routinely contain source code, system architecture, customer data, and credentials that have been pasted in. It sets out five categories of risk around AI agents, covering manipulation of the agent through planted instructions, agents being driven to return data beyond their permitted scope, impersonation of one agent by another, agents being coaxed into actions they were never authorized to take, and tampering with configuration, memory, or logs. Its figures put 88% of enterprises already experimenting with agents.

 

The big picture

Healthcare organizations face the same two entry points the report puts at the top, since staff open attachments and credentials get reused, and neither depends on an unpatched system. Microsoft's recommendation is for organizations to reduce oversharing, apply sensitivity-aware access and least-privilege controls, and govern how data is discovered, used, and shared across AI, cloud, and application environments, in the report's top ten takeaways. Shared drives and mailboxes accumulated over years sit badly against that advice, because an AI assistant given a clinician's permissions inherits everything those permissions reach. The report also argues for shifting what gets measured, moving reporting away from counting patches deployed and toward reduced exposures and increased detection coverage.

 

FAQs

What is business contact impersonation?

An attacker poses as a supplier, partner, or colleague the recipient genuinely deals with, often continuing a real conversation or referencing a real transaction. It differs from brand impersonation in targeting an established relationship rather than a recognizable company name.

 

Why does credential theft follow an intrusion that already used valid credentials?

The first account rarely holds everything an attacker wants. Harvesting further credentials from that position extends access to other systems and provides fallback entry if the original account is disabled.

 

What does 5.3 hours to attack mean for cloud deployments?

A workload exposed to the internet, whether deliberately or by misconfiguration, is found and probed within hours rather than days. Deployment processes that leave security configuration for later assume a window that does not exist.

 

How does an AI assistant inherit permissions?

Assistants typically operate with the access of the user who invokes them, so an assistant asked to summarize or search will reach whatever that person could open. Where permissions have accumulated over years, the assistant surfaces material the user never knew they could access.

 

What does measuring exposure rather than patches involve?

Reporting on how much of the attack surface has actually been reduced, how much of the environment detection covers, and how quickly issues get mitigated, rather than how many updates were installed. A high patch count says nothing about whether the systems most exposed to attack were among them.